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FOREWORD 

This document completely updates and consolidates the results 
of three previous studies to compile, interpret, and analyze orbital 
reliability data on U.S. spacecraft. Both the earlier studies and this 
update were performed by Planning Research Corporation (PRC). The first 
study was conducted from 13 May 1966 to 3 March 1967 for the Apollo 
Support Department of the General Electric Company in cooperation with 
Headquarters, National Aeronautics and Space Administration. The 
second and third studies were part of a larger effort for the Navy 
Space Systems Activity; they reported on work conducted from 
1 November 1970 to 30 November 1971, and from 1 December 1971 to 
30 November 1972. This update was prepared for NASA Headquarters. 

Mr. Abe Moskovitz was the Technical Monitor. This work was 
performed under contract number NASW-3041. 

The authors wish to express their gratitude for the cooperation 
of the various program offices in making data available for this study. 
Many individuals, both in government organizations and in private indus- 
try, assisted in the development of the study data. Without their 
assistance and cooperation, the large data base could not have been 
generated. 

Members of the PRC study team were V. Anderson, C. Bloomquist, 
0. OeMars, W. Graham, P. Henmi, and G, Stiehl. In addition, the authors 
wish to acknowledge the efforts of J. Amos, H. Thomas, and J, Zell for 
their assistance In report preparation. 
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This report documents four studies investigating the on-orbit 
reliability of spacecraft. The total effort included compiling, inter- 
preting, and analyzing operational and historic data for 350 spacecraft 
from 52 U.S. space programs. 

Failure rate estimates are made for on-orbit operation of space- 
craft subsystems, components, and piece parts, as well as estimates of 
failure probability for the same elements during launch. Confidence in- 
tervals for both parameters are also given. 

Based on the total data sample (this study and previous ones), 
the results indicate that: (1) the success of spacecraft operation is 

only slightly affected by most reported incidents of anomalous behavior, 
(2) the occurrence of the majority of anomalous incidents could have 
been prevented prior to launch, (3) no detrimental effect of spacecraft 
dormancy is evident, (4) cycled components in general are not demonstra- 
bly less reliable than uncycled components, and (5) application of 
product assurance elements is conducive to spacecraft success but the 
effect cannot be quantified on the basis of the data considered in this 
report. 
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I. INTRODUCTION AND SUMiARY 

This report is a coti?''ilation, analysis, and interpretation of 
orbital reliability data on U.S. spacecraft. It covers a period of 
nearly 20 years and is a synthesis of four individual data collection 
and analysis efforts. The previous study reports were published in 
1967, 1971 and 1972. 

A. STUDY OBJECTIVES AND SCOPE 

The common objective of this study and the previous ones is to 
achieve better utilization of reliability information inherent in space- 
craft operational data. All four studies have proceeded from the assump- 
tion that empirical on-orbit information might be applied advantageously 
to the planning and development of space systems. 

The current study has several subsidiary objectives: (1) to 

compile all the relevant data into a single volume, (2) to update the 
results of the earlier studies by considering NASA spacecraft launched 
subsequent to those included in the earlier data base, (3) to prepare 
six experience bulletins to highlight particularly pertinent study find- 
ings, (4) to extract information from the data base relative to the 
dormant or standby mode of spacecraft component operation, and (5) to 
attempt to relate observed project success to product assurance elements. 

B. GENERAL BACKGROUND 

Appendix A contain.* the basic data on all anomalous Incidents 
that have been collected in this study and the previous studies. 


Iht'v .H't' p?'t'sonttHl .'.s tour sots. Hu' sot contains ilata trom 

spaooorat't lannohoil prion to May Tho socofui sot o-,toni1s tho 

t nno ponoO to aiul incliiOos i,1ata f rom 79 mono spaooorat't. Tho t*”-'.l 
>iot ovtoiKis tf)0 viata baso anothor yoar ami aOJs six now spaooorat't. Ibo 
fourth sot. Oorivoii in tnis stiuiy, ovtomis tho timo porioci to 1977 ami 
.uKIs anotht'f -10 spaooorat't. Tho total viata baso covors 350 spaooorat't 
t roi'i b.’’ liittoront spaoo proorams. Appondix C provisos details on this 
data bank oovoraoo. 

Iho analvsos ot tho data in tho body of tho report is generally 
viivon tor two samples. Tho tirst is called tho pre-update sample and 
inoluilos all data t)\wi tho first throe data sets. The second is usually 
rotorrod to as "this sa'tiplo" or "this update" and includes only tho data 
oi'llootod tor this study. Whore tho results are not obvious tho data 
art' oi'i'tbinod tor all samples. 

r . PA 1 A P A S I . AN 1\ .1 .1 M.l.T A T jyW PJ_ All-'PA 

Tht' basic approach in all tour studios has boon to collect and 
analyco as much reliability data trom as many spacecraft as possible 
within cost and schedule constraints. Tho first data set includes all 
kinds of spacecraft. The second and third sots wore tienerally restricted 
to lonu-term spacecraft. This data set includes only NASA spacecraft. 

The basic data elements were collecttnl and recorded for individ- 
ual spacecraft. It is not tho intent of these st.idies to explicitly aw- 
pare either space proorams or spacecraft within a ^ivon pro'iram. For 
this reason, and at the reouost of many procjram offices, prvxqram and 
s('acecraft idont i f ication have been withheld in most analyses. The 
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basic data recordeo ror each program is available at NASA Headquarters, 
Code DP-4. 

An important underlying bias of the study analyses is one conrion 
to all large-scale reliability data studies. In the context of the sub- 
ject matter of this report, the bias is that the spacecraft anomalies 
analyzed are "reported" anomalies rather than the desired "occurred" 
anomalies. The large and varied data base, however, tonds to minimize 
the effect of this bias. 

The information provided by the study analyses is extensive and 
covers several areas relating to the reliability of spacecraft. For the 
convenience of readers of varied backgrounds and specialized interests, 
this report has been organized so that analyses pertaining to particular 
interests appear in different sections. The summary below indicates 
these areas. 

D. SUMMARY OF RESULTS AND ORGANIZATION OF THE REPORT 

Details of the data base, contributing data sources, and the tech- 
niques of data analyses used are presented in Subsection II. A. For those 
readers who are interested only in the basic events on which all analysis 
was performed, the tabulation of specific events is presented in Appen- 
dix A. 

In this update, a total of 708 specific events* related .0 on- 
orbit spacecraft reliability were refined from the data provided by the 
various program offices, cooperating agencies and individuals. In the 
pre-update sample there were 1,472 specific events tabulated. In the 

The term "events" is defined here to include anomalies, unsuccessful 
launches, and spacecraft with no reported anomalies. 

Vl ^.1— L I ‘ ‘ ^ ^ ‘ --- 
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combined sample there are 2,180 such events. The classification and 
analysis of these events for this update and for the pre-update sample 
form the subject matter of the remaining subsections of Section II. Sub- 
sections II.C to II.E should be of particular Interest to design engineers. 

The classification of anomalous Incidents reported on the success- 
fully launched spacecraft (88 percent of all spacecraft hi the combined 
sample) result In the following major conclusions: 

1. Eighty-eight percent of the successfully launched space- 
craft reported one or more Incidents of anomalous behavior. 

2. In this update, 90 percent of the anomalies are reported 
in the orbital or steady-state phased of the spacecraft mission. In the 
combined sample, 77 percent are reported In the orbital phase. 

3. Ninety-four percent of the reported anomalies In this 
update have little or no effect on accomplishment of the spacecraft mis- 
sion; In the combined sample, 91 percent. 

4. Two subsystems account for over one- ha If of the reported 
anomalies. The telemetry ond data handling subsystem accounts for 19.3 
percent of the reported anomalies In th<s sample; 23 percent In wfie com- 
bined san^)le. The payload subsystem accounts for 26.2 and 25.8 percent. 
Thirty-seven percent of the ancNnalous Incidents are distributed essentially 
equally between timing and control, power supply, attitude control and 
stabilization and the remaining nine percent are also distributed essen- 
tially equally among the propulsion, envirormental control, and structure 
subsystems. 

♦The ortital, or stea<^ state, phase Is defined here as the phase following 
launch. Injection and acquisition. 
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5. Almost three-quarters of the anomalous Incidents re- 
ported both In this update and in the combined sample are electrical 
in nature as opposed to mechanical, chemical, unknown, etc. For those 
incidents where it could be determined whether the anomaly was caused 
by a piece-part, 12 percent of the Incidents in this sample and 19 per- 
cent in the combined sample were determined to be catastrophic part 
failures*; 20 percent in both samples were noncatastrophic part failures 
(degraded. Intermittent, etc.); 68 percent and 61 percent, respectively, 
were nonpart related. 

6. In this sample 36 percent of the anomalies were the re- 
sult of assignable (i.e., “preventable”) causes and 10 percent of the 
incidents had no assignable cause. In the combined sample the correspond- 
ing percentages were 35 percent and 13 percent. For the remaining incidents 
no conclusions could be drawn as to t.he assignability or nonassignability 
of cause of failure. For those incidents of this update having assign- 
able causes, nearly 68 percent were attributed to various aspects of the 
spacecraft design, 21 percent to manufacture, and 10 percent to spacecraft 
operation. The corresponding percentages for the combined sample are: 
design, 65 percent; manufacture, 14 percent; operation, 9 percent. 

Failure rate estimates for spacecraft subsystems, components, 
and piece parts are given in Section III. Included in that section are 
estimates of the probability of failure during launch for the same ele- 
ments and confidence Intervals for both parameters. Reliability engi- 
neers and analysts, as well as personnel responsible for program man- 
agement and advance system planning, should find Section III of special 

•the term ^catastrophic part failure" is defined as meaning catastrophic 
to the part, e.g., a transistor or diode, and not necessarily to the 
larger component or system. 
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interest. The parameters presented for spacecraft subsystems and commonly 
used components are felt to be a significant contribution to the relatively 
sparse information generally available on this type of data. 

Estimates of the spacecraft element reliability parameters » failure 
rate and probability of failure« in addition to their tabulation, result 
in the followin'; general conclusions: 

1. The combined sample indicates that the power and attitude 
control and stabilisation subsystems have the highest on>orbit failure 
rate among the subsystems. The propulsion, environmental control, and 
structure subsystems have no reported catastrophic failures during orbit 

2. The majority of the components considered in both samples 
exhibited no catastrophic failures either during launch or in orbital 
operation. The most failure-prone component appears, as it did in the 
earlier studies, to be the magnetic tape unit with 55 catastrophic failures 
occurring on 198 units observed. The failure rate for magnetic tape 
units in the combined sample is 24 failures per million hours, a signifi- 
cant decrease over that reported in the earlier sample (35 failures per 
million hours). Most other components have somehwat lower failure rates 
than those reported earlier. 

3. In the combined sample, there are five failures attributed to 
piece parts during launch and 56 during orbital operations. Forty-four part 
types are included in the study. The on-orbit failure rates of capacitors 
(1.0 per billion part hours), diodes (0.97 per billion part hours), and tran- 
sistors (1.5 billion part hours) reflect the large number of observed units 
and operating time and the relatively few observed on-orbit failures. 
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The analyses relative to the secondary objectives of this study 
are presented In Section IV. 

The effect of dormancy on reliability 1$ somewhat ambiguous. 

The analysis of this factor does demonstrate conclusively, on the basis 
of empirical data, that magnetic tape units and transmitters have a much 
higher operating failure rate than dormant failure rate. No failures or 
anomalies were Identified which could be attributed to dormancy. 

As reported earlier, the analysis of on/off cycling gives no clear 
evidence of a supposed detrimental effect on reliability of cycling space- 
craft components as opposed to a steady state operation. The data do in- 
dicate, hoiKver, that for cycled components a rapid cycling rate is more 
adverse than a slower one. 

No quantitative relationship between product assurance elements 
and spacecraft mission success could be demonstrated fron the available 
daU. Several particular points meriting attention by spacecraft project 
managers are contained in six experience bulletins. 

Supporting tabulations for the entire study will be found In the 
appendices *• text references to the appropriate appendix sections are 
provided. 
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II. CLASSIFICATION AND ANALYSIS OF ANOMALOUS INCIDENTS 

The objectives of this section are to consider all reported In- 
cidents that affect the capability of a spacecraft to perform as desired, 
to classify these Incidents In a meaningful and organized manner, to ana- 
lyze the Incidents In areas of Interest, and to draw conclusions generally 
applicable to the U.S. space program. 

A. BACKGROUND AND GENERAL APPROACH 

The purpose of this study Is to continue the examination of on- 
orbit spacecraft reliability reported in three earlier studies (see Ref- 
erences 1, 7 and 9). The earlier studies collected data on 42 space pro- 
grams and 310 spacecraft. This study Is an "update" to the earlier re- 
ports; therefore, data have been sought for both new programs and addi- 
tional spacecraft of the programs In References 1, 7, and 9. The major 
emphasis of the current report Is on NASA spacecraft launched In a seven- 
year time Interval starting In 1970. 

The same data collection and reduction procedures are employed 
In each study. All of the reliability reports. Including the current 
one, use the same format. This uniformity allows for analyses and 
results of the four data sets to be combined In this report Into a 
large body of Information about the reliability of spacecraft from 
19S8 to June 1978. For this report, the data are generally presented 
In two groups or samples, one representing all data collected prior 
to this study and the other representing this sample or update only. In 
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son« cases (such as for failure rates) results are given for the combined 
sample as well. 

1 . Data Sample 

Exhibit 1 depicts the four on-orbit reliability studies. 
Including the current one in terms of the programs and number of space- 
craft considered. As shown in Exhibit 1, the 1978 update Includes 45 
spacecraft from 20 programs. Five of these 45 spacecraft were studied 
In earlier reports and have continued to operate into the period of In- 
terest to this study. 

In all analyses of the combined sample (from all four studies) 
the data have been adjusted to reflect the non- Independence of the samples. 
In other words, corresponding data entries In tables presented for the 
ore- and poc,t-update samples will not necessarily sum to the correspond- 
ing data element for the combined sample. Thus, the data for the com- 
bined sample are based on the operational records of 350 spacecraft from 
52 programs. 

2. Sources of Study Data 

Requests for specific data elements were made to cog- 
nizant .ponsoring agencies for specific programs. Many of these agen- 
c1«*s had previously been contacted for data utilized In the earlier 
studies. Contacts were made to: 

NASA Project Offices (Goddard Space Flight Center, Ames 
Research Center, Lewis Research Center, Langley Research 
Center, Wallops Flight Center, Marshall Space Flight 





EXHIBIT 1: CUMULATIVE STUDY DATA SAMPLE 
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Center, Jet Propulsion Laboratory) 

NASA Headquarters 

NOAA (National Environmental Satellite Service) 

The open literature also provided significant amounts of all 
types of required data. The primary source of these data was the 
National Technical Information Service (NTIS, Springfield, Virginia) 
microfiche copies of government contract reports and symposium 
proceedings. 


3. Methods of Data Compilation 

The types of documentation sought for this study were 
similar to the earlier studies. The two major types of data are: (1) 
an engineering report of the final design of the spacecraft, and (2) 
a flight analysis for individual spacecraft from which operating 
histories and all known anomalous behaviors can be obtained. From this 
information Engineering Analysis Reports (EARs) are generated for each 
spacecraft. The EAR is tailored to provide the information content 
required to meet the study objectives and provides a uniform base for 
each spacecraft of the study. The EAR is completely described in 
Appendix B. 

In the EARS the treatment of standby and redundant units is con* 
sistent for all data samples and emphasizes the utilization of only known 
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values. Operational hours In the EARs were recorded as "powered” and 
"unpowered*- where such Information was known. For much of the equipment, 
however, the Information available only Indicates that at a given time 
the equipment was known to be operational. For this reason the unit of 
measure In the analyses of this section and of Section HI Is survival 
time. In those Instances where standby hours are reported. It Is known 
that the unit In question was turned off for the given number of hours 
and known to have been subsequently operational. These data are analyzed 
In Section IV. 

Redundant equipment was treated In the following manner. If a 
spacecraft had an active redundancy composed of, say, two units, and If 
the descriptive material Indicated that It was reasonable to assume both 
units operated successfully for, say, 1000 hours, then two entries are 
made for the two units. On the other hand. If all that could be deter- 
mined was that one or the other operated for the given time, th«i only 
one entry was made. 

4. Methods of Data Analysis 

a. Techniques and Parameter Estimation 

The authors believe that the crux of studies 
of this nature Is the provision of a large amount of data In a readily 
usable form. For this reason, as well as the fact that the Information 
from the docimentatlun does not warrant application of highly sophisti- 
cated techniques, the methods of analysis are simple and straightforward. 

Classification and summarization, using simple, readable tables, 
are the primary presentation techniques. In general, statistical 
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inferences are not drawn from these efforts. At the coroponent/equlpment 
level and p1ece>part level, failure rates have been 9 enerated using tech* 
niques which are generally accepted. Conclusions have been drawn where 
appropriate, but the emphasis is placed on presenting data in such a form 
that readers may easily draw their own conclusions in areas of their 
special interest. 


b. Assumptions and Biases 

Because of the emphasis on recording only known 
values for the various data elements, engineering assumptions are held 
to a minimum in the generation of an EAR. 

The major assumption underlying the estimation of failure rates 
Is that time* to-fai lure is adequately expressed by the negative exponen- 
tial distribution. The data generated herein preclude the use of an 
alternate assumption, a situation that also existed in earlier studies. 

The major bias In the study continues to be that all anomalous 
incidents in the analyses are '’reported*' incidents versus the desired 
"occurring" incidents. The cause of the bias can be traced to several 
sources: (I) diversity of detail, (2) method of documentation en^loyed 
by the various program offices, (3) reliance in some cases on personal 
interviews, and (4) state-of-the-art limitations (i.e., part operational 
data). 

Documentation for the spacecraft in this sample was significantly 
more detailed and of higher quality, on the average, than in the earlier 
studies. 









5. Definitions 


Definition of terms used In this report Is presented In 
context; terms requiring definition are generally associated with anomaly 
classifications. The use of acronyms has been kept to a minimum and 
those that are used are easily Identifiable; mathematical symbols are 
those in general use. 

B. SUMMARY OF REPORTED INCIDENTS 

From the spacecraft EARS, a summary of all anomalous incidents 
has been compiled for each of the four study samples. The summary for 
this study is found in Appendix A-IVa and is in the same format as the 
corresponding lists for the earlier studies (see Appendices A- la, A-IIa, 
and A-IIIa). The format lists in the following order: unsuccessful 
launches; every anomalous incident recorded In the EARs subsequent to a 
successful launch; and finally, every sucessfully launched spacecraft In 
which no anomalous incidents were recorded. 

Each line entry in the appendices referred to above inclines first 
an index relating the entry to a specific program and spacecraft.^ For 
those launches that were unsuccessful, this fact is entered to complete 
the entire entry. In cases where no anomalous behaviors were noted, this 
fact, plus the total time in orbit and whether the spacecraft is currently 
operable or not, completes the entry. Each anomalous incident recorded 
contains the following information in each entry: 

Hhis relationiliip between the index and specific launch 1$ not available 
to the reader and is a method of preserving the anonymity of programs and 
spacecraft. 
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1. Time the incident occurred. An entry of e indicates 
that the incident occurred between the end of countdown and the establish- 
ment of the initial orbit. An entry of ' indicates that the anomaly 
cannot be pinpointed in time since it was intermittent, gradual, or un- 
known. All other entries are in hours. 

2. Three short statements giving a description of the inci- 
dent, its cause, and its effect on the mission as a whole. 

3. Any known corrective action taken to prevent occurrence 
of the incident on future flights or to obviate its effect on the flight 
under consideration. 

4. Other clarifying remarks required to put the Incident in 
the proper context. 

It should be made clear that this listing does not pretend to be 
exhaustive of all such Incidents that have occurred, even on the space- 
craft reported in this study, because of the wide variability in quantity 
and quality of data available to the study. Th/^re is no reason to be- 
lieve, however, that it is not indicative of spacecraft reliability 
problems. 


C. 


CLASSIFICATION OF ANOMALOUS INCIDENTS 
1. Sunroary of Classification Codes 

Because of the large number of anomalous Incidents In this 


sample (and in the previous samples) classification and summarization is 


mandatory to extract readily usable information. A coding scheme, iden- 
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tlcal to that used in previous studies is used to accomplish this pu»pc<«. 
There are nine characteristics for which each anomalous incident is coded. 
Some information needed to select a particular code for a given entry oc- 
curs only in the EARS so that, in a sense, the classification carries more 
information than provided in the entries of Appendices A-Ia, A-IIa, A-Illa 
and A-IVa. The complete coding of each entry is given in Appendices A-!b. 
A-IIb, A-IIIb, and A-IVb. 

Exhibit 2 lists the names of eight of the classifications used. 
Definitions of the terms are given in the following paragraphs, together 
with the results of the classifications of the anomalies. Roman numerals 
following the paragraph headings refer to the Roman numerals in Exhibit 
2. The ninth classification. Subsystem Function, is discussed in Subsec- 
tion D. 


2. Hission Subset (!) 

This code simply Identifies the unsuccessful laimches (U) 
and those spacecraft for which there are no reported anomalies (S). 

For this update, two of the 45 spacecraft launches were unsuccess 
fuli there were no spacecraft that experienced zero anomalies. Five of 
the 43 successfully launched spacecraft were considered in the previous 
study as well as this one. Therefore, for the combined sample: 

e Total Number of Spacecraft: 350 

e Unsuccessful La\mches 43 
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fXHiaiT 2 - ANOMALOUS INCIDENT CLASSIFICATION CODES 

I. Mission Subset 

c. Power Supply 

u. Unsuccessful Launch 

d. Attitude Control and 
Stabilization 

S. Spacecraft with No 
Anomalies Reported 

dt Propulsion 

Spacecraft with 
Anomalies Reported 

e. Environmental Control 

11. Mission Term 

f. Structure 

L. Long Term 

g. Payload (Experimental 
and Scientific) 

L. Short Term 

h. Unknown 

111. Mission Phase 

VI. A. Incident TyM 

L. Launch and Acquisition 

E. Electrical 

0. Orbital (Steady-State) 

M. Mechanical 

Q. Unknown 

0, Other 

IV. Mission Effect 

U. Ikiknown 

1. Negligible 

VI. B. Incident Type 

2. Non-Megllgible but Small 

C. Catastrophic Part 

3. 1/3 to 2/3 Mission Loss 

Failure 

4. 2/3 to Nearly Total 
Mission Loss 

0. Other Part-Related 
Incident 

5. Essentially Total 
Mission Loss 

N. Non-Part-Related 
Incident 

U. Unknown 

U. Unknown 

V. Spacecraft Subsystem 

vu. Incident Cause 

a. Timing* Control end 

A. Assignable 

CoNwnd 

N. Hon-Assignable 

b. Telemetry and Data 
Handling 

U. Unknown 




LJ 





•Am^rn 




i 


iJJ.' 
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e 

Total Spacecraft Reporting No ArHxnalies: 

40 

e 

Total Spacecraft Reporting Anomalies 

267 

e 

Total Anomalies Reported: 

2,096 


The breakdtown, by nun^r of spacecraft and percentage is as follows: 


I. Mission Subset 

U. Unsuccessful 
Launch 

S. Spacecraft 
Mith No 
Anomalies 
Reported 

Spacecraft 

With 

Anomalies 

Reported 


Number 

Total 
Pre- Data 
Update Update Base 


2 41 43 


0 40 40 


38 229 267 


Percent 

TotaT 

Prc Data 
Update Update Base 


5.0 13.3 12.3 


0 12.9 11.4 


95.0 73.8 76-3 


3. Mission Term (11 ) 

The code identifies long-term (L) or short-term (S) mis- 
sions. If a mission Is anticipated to be longer than 60 days it is clas- 
sified long-term. All spacecraft except one in this data sample are long- 
term missions; the total sample conUins 138 short-term ard212 long-term 
missions. In the update data, there were 70S anomallei associated with 
long-term missions, and one anomaly with the short-term mission. For t»» 
total data base, 79.1 percent of the anomalies are associated with long- 
term missions, and 20.8 percent with short-term missions. 


The breakdown, by number of anomalies and percentages, Is as 


follows: 


N umber Percentage 


Pre- 

Total 

Data 

Pre- 

Total 

Data 

Update Update 

Base 

Update Update 

Base 


n. Mission Term 
L. Long Term 

705 

990 

1,695 

99.9 

71.9 

80.9 

S. Short Term 

1 

‘400 

401 

0.1 

28.6 

19.1 


For this sample, the average number of anomalies reported Is 
17,8 per long-term spacecraft. This Is significantly greater than the 
pre-update figure of 7.1 anomalies per long-term spacecraft. This In- 
crease appears to be due In part to the Increased detail of reporting on- 
orbit experience and In part to the Increased complexity of spacecraft 
iv. this sample. That Is, many spacecraft carried more equipment than 
those launched earlier and therefore were subject to more anomalies. For 
the combined sample, the number of anomalous entries per long-term space- 
craft Is 9.7. 

Further analysis concerning detailed anomaly times will be found 
fn subsection II-D-1 below. 

Mission Phase (III) 

A spacecraft mission can be thought of as consisting of 
two distinct phases: launch and acquisition (L) and the orbital or steady- 
state phase (0). An anomaly occurring during launch and acquisition Is 
classified Lj If It occurs during steady-state operation It Is classified 
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0. A third category* Q, Is provided for those Instances t^ere the dichot* 
on^ cannot be made due to Insufficient Information. The distinction was 
made on the best judgment available based on the engineering analysis re- 
ports. Generally, those Incidents Indicating an e , or very few hours 
of elapsed time at occurrence* are classified as L* all others as 0. 

The breakdown of anomalies occurring In each category and the 


associated percentages 

Is as follows: 
Number 



Percentage 



Update 

Pre- 

Update 

Total 

Data 

Base 

Update 

Pre- 

Update 

Total 

Data 

Base 

III. Mission Phase 

L. Launch and 
Acquisition 

5b 

415 

480 

9.2 

29.8 

22.9 

0. Orbital 
(Steady- 
State) 

636 

970 

1*608 

90.4 

69.8 

76.7 

Q. Unknown 

3 

5 

8 

0.4 

0.4 

0.4 


The 29.8 percent of all anomalous Incidents occurring In the 
launch phase previous to this update* reflects* at least In part* the 
fact that all Ranger* Mercury* and Gemini missions were defined to con- 
sist of launch and acquisition phase only and that many other spacecraft 
(e.g., Agena) were relatively short-term. The 9.2 percent of all anomalies 
In this update occurring during the launch phase compares reasonably well 
with the pre-update sample when considering the spacecraft complement of 
the pre-u^date sample. 

5. Mission Effect (IV) 

The five groups Included In this classification Indicate 








p- , I f- 
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tht stvtfity of th« anomalous Incldtnt In torms of Its offoct on tht ovtr- 
all mission had it occurrad in isolation, Tha definition of each class U 
3« 4, and 5 should be self-evident from the classification names 9 iven 
in Exhibit I, ThuSt in column IV of the tables in Appendices A-Ib» A-IIb» 
A-lUb, and A-lVb, all incidents ceded 1 have essentially nedli^ible effect 
on mission performancei those coded S ace essentially catastrophic to the 
mission. The code U indicates there was insufficient information on which 
to assign a mission effect code. 

The breakdown of these g>*oups« by number and percent of anomalies, 
is as follows; 




Number 


Percentaoe 



Update 

Pre- 

Update 

Total 

Data 

Bast 

Up^te 

iiijinninjafiYi 

Pre- 

Update 

Total 

Data 

Base 

IV. Mission Effect 







1. Negligible 

SOS 

62$ 

1,330 

n.s 

59.4 

63.4 

2. Non-Negligible 
but Small 

161 

418 

5/9 

22.B 

30.1 

2/. 6 

3, 1/3 to t/3 
Mission loss 

13 

as 

9S 

i,a 

6.1 

4./ 

4, 2/3 to Neerly 
Total Mission 
loss 

0 

20 

20 

0 

1.4 

0.9S 

S. Essentially 
Total Mission 
loss 

4 

40 

44 

0,6 

2.9 

2.1 

U. Unknown, 

23 

2 

IS 

3.3 

0.1 

1.2 


An observation made on the pre-update sample holds both for this 
update and the combined sample. That iSt very few spacecraft drop out of 
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tht sample as a result of a single failure (coded 5). Maximum sample time 
for the spacecraft Is far more likely to result from the cumulative effects 
of several lowr severity level anomalies, planned mission termination, or 
simply, the extent of the available data. 

Spacecraft Subsystem (V) 

Each anomalous Incident Is coded according to which of 
eight major spacecraft subsystems 1$ most closely related to the Incident. 
An unknown category Is Included for those cases where a relationship does 
not exist or cannot be determined from the available Information. The 
subsystems used for this classification are meant to define broad function- 
al operations found to one extent or another In all spacecraft. The func- 
tional definition for subsystem was chosen rather than a definition based 
on hardware for two reasons. First, subsystem definitions vary annng 
organizations and among program offUes of the same org«n1zat1on. The 
data analysis requires a grouping that can be applied to all spacecraft of 
the collective data sample. The second and more Important reason for 
using a functional definition is that. In the predesign stages of future 
programs, the program management will know what functions the planned 
spacecraft Is expected to perform with more certainty than the actual 
hardware configuration that will be used to perform the desired functions, 
the comparisons at the subsystem level as defined In this report would be 
useful In the predesign phase of program development. For example, one 
would be Interested to know, based on past experience of other programs, 
with what certainty a spacecraft would deploy Its structural elements 
(structure subsystem) or supply power to the other planned functions 



(power supply subsystem). In the later stages of development of a pro 
jected program, when more Is known about the hardware configuration, the 
Interest would shift to the equipment group/component level of analysis 
which Is hardware oriented. 

The following list defines the subsystems and Indicates the 
types of equipment that are consioered to be a part of each subsystem, 
a. Timing, Control and Command 

Command receivers, decoders, timers, programmers, 
sequencers, command distribution equipment 
t>* Telemetry and Data Handling 

Encoders, 0/A converters, A/0 converters, tape 
recorders, signal conditioners, telemetry trans« 
mitters, tracking transmitters, antennas 

c. Power 

Batteries, solar arrays, fuel cells, converters. 
Inverters, regulators, protective devices, 
charge regulators 

d. Attitude Control and Stabilization 

Qyros, spin control, magnetometers, sun aspect 
Indicators, eddy current dampers, horizon scan- 
ners, star trackers, dynamic control 

d? Propulsion 

Coding this subsystem with a d* Indicates that 
the propulsion subsystem considered here Is 
more closely related to the attitude control 
subsystem of the spacecraft than to the launch 
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vehicle. Included are hydrazine thrusters, 
tanks, valves, etc. 

e. Environmental Control 

Both passive and active thermal control 
devices, life support systems. 

f. Structure 

Basic structure, booms, solar paddles, 
separation. 

g. Payload (Experimental and Scientific ) 

Wide-band communications (for spacecraft where 
this equipment was considered experimental), 
microwave equipment (cavities, TVfTs, etc., 
flown for assessment purposes), university 
experiments, particle detectors, mass spec- 
trometers, plasma analyzers, infrared radio- 
meters, ultraviolet radiometers. 

Although it is felt that these groupings are essentially self- 
explanatory, checking a few of the codes in Appendices A-Ib, A-IIb, 
A-Illb, and A-IVb with their corresponding entries in Appendices A-Ia, 
A-IIa, A-IIIa, and A-IVa should dispel any confusi*. >'is procedure 
is applicable to most of the other classifications as well. 

The breakdown, in terms of number of anomalies and their 
associated percentages, to each of the subsystem categories is as 
follows: 




Number Percentage 



Total 


Total 

Pre- 

Data 

Pre- 

Data 

Update Update 

Base 

Update Update 

Base 


Spacecraft Subsystem 






a. Timing, Control 
and Command 

76 

214 

290 

10.8 

15.4 

13.8 

b. Telemetry and 
Data Handling 

136 

463 

599 

19.3 

33.3 

28.6 

c. Power Supply 

68 

131 

199 

9.6 

9.4 

9.5 

d. Attitude Contro 
and Stabiliza- 
tion 

104 

183 

287 

14.7 

13.2 

13.7 

d? Propulsion 

31 

31 

62 

4.4 

2.2 

2.9 

e. Environmental 
Control 

7 

29 

36 

1.0 

2.1 

1.7 

f. Structure 

28 

19 

47 

4.0 

1.4 

2.2 

g. Payload 
(Exp'-Tlmental 
and Scientific) 

256 

284 

540 

36.2 

20.4 

25.8 

h. Unknown 

0 

36 

36 

0.0 

2.6 

1.7 


The relatively large percentage of reported anomalies In the 
telemetry and data handling subsystem as Indicated In the above breakdown. 
Is to be expected. Since this subsystem Is, of course, monitored more 
closely than other subsystems, an Indication of an anomaly is more likely 
to be observed In this area. The large number of payload anomalies In 
this sample relative to the number In the pre-update sample. Is felt to 
be due In part to the large number of payloads relative to other sub- 
system functions In the update. Also, payloads are often unique, push the 
state-of-the-art, and are constructed with fewer quality assurance 


provisions less stringently enforced than basic spacecraft subsystems. 
Finally, the payloads carried by recent spacecraft tend to be more com- 
plex than those carried by many of the spacecraft in the pre-update 
sample, and this may lead to more anomalous Incidents per payload. 

Exhibits 4 and 5 provide additional Information tending to confirm the 
Increase In payload anomalies. 

7. Incident Type (VI ) 

a. Incident Type (VI. A) 

This classification places an anomaly in one of 
four mutually exclusive groups: electrical (E), mechanical (M), other 
(0), and unknown (U). Those entries in Appendices A-Ib, A-IIb, A-IIIb, 
and A-IVb coded with an E In the VI. A column Indicate that anomalous 
behavior Is exhibited by electrical or electronic parts, components, sub- 
systems, or functions. Those anomalies coded M are similarly defined for 
mechanical parts, components, subsystems, or functions. An 0 Indicates 
behavior of equipment that cannot be classified electrical or mechanical: 
propellant degradation, for example. A U Indicates Insufficient Inform- 
ation to assign the entry to any of the other three categories. 

The breakdown of anomalies and percentages In this classification 


group 

Is as follows: 


Number 


Percentage 


VI.A. 

Incident Type 

Update 

Pre- 

Update 

Total 

Data 

Base 

Update 

Pre- 

Update 

Total 

Data 

Base 

« 

E. 

Electrical 

473 

1,065 

1,538 

67.0 

76.6 

73.4 

M. 

Mechanical 

66 

126 

192 

9.3 

9.1 

9.2 

0. 

Other 

60 

98 

158 

8.5 

7.0 

7.5 

U. 

Unknown 

107 

101 

208 

15.2 

7.3 

9.9 
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b. Incident Type (Vl.B ) 

The classification of column Vl.B In Appendices 
A-Ib, A-IIb» A-Illb, and A-IVb attempts to divide Incidents Into those 
that are part related and those that are nonpart related. A code of C 
Indicates those Incidents arising from a catastrophic part failure*. An 
0 Indicates that the anomalous Incident Is related to behavior of a 
part (or parts) that has not failed catastrophically (degraded, Inter- 
mittent, etc.). An N Indicates an anomalous Incident not related to any 
part misbehavior. A U Indicates that Insufficient Information exists 
to determine whether part behavior was Involved or not. 

The breakdown by number and percentage of anomalies for these 
categories Is as follows: 


Vl.B. Incident Type 

C. Catastrophic 
Part Failure 

0. Other Part- 
Related 
Incident 

N. Non-Part- 
Related 
Incident 

U. Unknown 


Number 

Update 

Pre- 

Update 

Total 

Data 

Base 

42 

183 

225 

68 

174 

242 

237 

490 

727 

359 

543 

902 


Percentage 


Update 

Pre- 

Update 

Total 

Data 

Base 

5.9 

13.2 

10.7 

9.6 

12.5 

11.5 

33.6 

35.2 

34.7 

50.8 

39.1 

43.0 


* The term "catastrophic” here Is defined to mean "catastrophic” to the 
part and not necessarily to the larger component or system. Typical 
types of catastrophic part failures Include a transistor or d^jde 
shorting for no known reason. This definition Is consistent with that 
used In the negative exponential distribution for modelling failure 
probability. 




V 
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Of the 347 incidents In this update where it could be determined 
whether the anomaly was part or non-part caused, 110 (31.7 percent) wei i 
piece part related. Of these, 42 (12.1 percent) were catastrophic piece 
part failures. Of the 1,194 Incidents In the total data base for which 
this determination could be made, 39.1 percent were piece part related, 
and 18.8 percent were catastrophic piece part failures. 

It Is Important to note that. In the pre-update sample, of the 
847 anomalous incidents where a relationship could be coded, over three- 
quarters (78.4 percent) are not catastrophic part failures, and thus not 
representative of the type of failures modeled by the classical reliabi- 
lity approach. In this update, this tendency Is even more pronounced. 

Of the 347 anomalies where a relationship could be determined, 87.9 per- 
cent are not catastrphic part failures. 

Further analysis of part types will be found In Section III, 
where survival hours and anomalous Incidents are used as the basis for 
reliability calculations. Further analysis on the effects of part fail- 
ures will be found In subsection II-D-4 below. 

8. Incident Cause (VII ) 

Three broad groups are defined for Incident cause In 
column VII of the tables In Appendices A-Ib, A-IIb, A-IIIb, and A-IVb; 
assignable causes (A), nonassignable causes (N), and unknown (U). 

An assignable cause Is attributed to an anomalous Incident If 
the Incdlent could have been prevented by taking some action well 
within the state-of-the-art prior to launch. If the Incident could not 
have been prevented In this manner. It Is classified nonassignauie (N). 

If Insufficient Information exists to make a Judgment, the anomaly Is 







classified unknown (U). 

The breakdown for these categories Is as follows: 





Number 


Percentage 

VII. 

Incident Cause 

Update 

Pre- 

Update 

Total 

Data 

Base 

Update 

Pre- 

Update 

Total 

Data 

Base 

A. 

Assignable 

255 

477 

732 

36.1 

34.3 

34.9 

N. 

Non-Ass Ignable 

71 

193 

264 

10.1 

13.9 

12.6 

U. 

Unknown 

380 

720 

1*100 

53.8 

51.8 

52.5 


The categorization of colimn VII Is of major Interest. In both 
this sample and the pre*update sample* the data Indicate that over one- 
third (at least) of the Incidents have assignable causes and thus form a 
clear basis where reliability of spacecraft might be Improved. Since over 
half of the anomalous Incidents were classified "unknown"* the percent- 
age of anomalies with assignable causes Is probably much higher. Further 
discussion of the assignable cause category Is given In Subsection I 1-0-3 
below. 

9. Subsystem Function (VIII ) 

This classification Is a secondary breakdown of space- 
craft subsystem* and Is treated In detail In Subsection 11-0-2 below. 

10. Remarks 

When the 2*096 anomalous incidents of the combined 
sample are categorized according to the characteristics discussed above* 
the results Indicate that the typical reported anomaly occurs on a long- 




term mission in the orbital phase, has a negligible effect on the mission, 
occurs in a payload, and is of unknown origin and cause. 

0. FURTHER OBSERVATIONS MADE FROM ANOWLOUS INCIDENT CLASSIFICATIONS 

Subsection C above has served to give a large picture of the 
anomalous incidents reported in this study. It is the Intent of this sub- 
section to examine, in more detail, four of the characteristics used in 
the preceding subsection to classify anomalous incidents. The four 
characteristics of interest in this further analysis are: Nission Phase, 
Spacecraft Subsystem/Subsystem Function, Incident Cause and Catastrophic 
Part Failures/Nission Effect. The analysis of this subsection, then, is 
concerned with the time of anomaly occurrence, its location within the 
satellite, its assignable cause, and the effect of part failures on 
mission performance. 

1. Mission Phase 

The classification used above for this characteristic 
somewhat arbitrarily considers the anomaly to have occurred either during 
launch and acquisition or the steady-state, orbital phase of the mission. 
Since time is of paramount interest in reliability studies, the analysis 
of this section focuses on the occurrence of the incidents as a function 
of time. 

The following analysis is based on the 211 long-term spacecraft 
of the combined sample.^ For the 177 successfully launched, long-term 

^One long-term spacecraft is not included because mission time is not 
available. 
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spacecraft, there are 1,695 associated Incidents of anomalous behavior. 
Exhibit 3 lists the sample hours associated with each spacecraft, along 
with the number of anomalies that occurred on each spacecraft. The 
sample hours are the lengths of time for which data on anomalous behavior 
are available to this study. In some cases, "sample hours" represents the 
complete loss of the mission; In others It singly represents the extent 
of the available data. The Index Number Is a code used to protect the 
Identity of the spacecraft. 

Note that use Is made In Exhibit 3 of the symbol e . This 
symbol Implies that loss of mission occurred very early, generally during 
the launch and acquisition phase. 

The rate of reported anomalous Incidents as a function of time 
can be derived from Exhibit 3. During e (essentially launch and acqui- 
sition) the reported anomaly rate Is 0.04 anomalies per spacecraft. 

During the first 1,000 hours, the anomaly rate Is 0.10 anomalies per 
spacecraft. The overall anomaly rate (subsequent to e ) Is 0.37 
anomalies per spacecraft per thousand hours. 

For short-tern systems, an analysis similar to the preceding Is 
not particularly Instructive because of the short mission times. In 
general less than 100 hours, and the concomitant short time to anomaly 
occurrence. There are 129 successfully launched short-term spacecraft 
Included In the conR}1ned sample, and there are 401 associated anomalies. 
Of the 401 anomalies only 127 have a recorded occurrence time other than 
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epsilon. These 127 iociOonts are distributed in tins: as follows. 


Time of Occurrence 


Number of 
Anomalies 


ljl M\/UI J # 

0 < t < 1 

9 

1 < t < 2 

6 

2 < t < 3 

4 

5 

8 

6 

1 

7 

1 

8 

3 

9 

4 

10 

1 

10 < t < 20 

7 

20 < t < 30 

14 

30 < t < 40 

3 

40 < t < 50 

7 

50 < t < 60 

2 

60 < t < 70 

2 

70 < t < 80 

7 

““ 

80 < t < 90 

2 

90 < t s 100 

8 

100 < t < 200 

22 

200 < t s 300 

n 

300 < t s 400 

3 

t > 400 

2 
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Spacecraft Subsystem Analysts by Functional Qroups 
The assignment of anomalies to the subsystems (character- 
istic V) Is helpful In narrowing down the functional aspect of spacecraft 
which Is the most troublesome. A further step In this direction Is jus- 
tified to Isolate more precisely the location of anomalous Incidents. 

To do th^s a number of subfunctions (characteristic VIII) are defined for 
each p»'ev1ously defined spacecraft subsystem. The subfunctions for each 
subsystem are defined so that they are mutually exclusive and exhaustive, 
I.e., they do not overlap and they do cover the entire subsystem. Each 
anomalous Incident carries, therefore, two codes relating the Incident 
to functional location within the spacecraft. The subsystems, subfunc- 
tions, and codes used for each are tabulated In Exhibits 4 and b. Ex- 
hibit 4 gives the total number of functions In the update san^le, the 
total number of anomalies observed, and the anomalies per function for 
this update. Exhibit 5 presents the same Information for the pre-update 
samples. 


Incide nt Cause— Assignable 

The Interest In further examination of the anomalous In- 
cidents classified as having assignable causes (characteristic VII) stems 
from the observation that a major way to Increase the reliability of 
spacecraft Is to remove all causes of anomalistic behavior. Of the 706 
anomalous Incidents In this sample, 255 can be assigned a cause of occur- 
rence, and of the 1,390 Incidents In the pre-update sample, 477 can be 
assigned a cause of occurrence. These Incidents are examined In this sub- 
section to discover the contribution they could make In pointing out 
problem areas. 
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EXHIBIT 4 - DETAILED CLASSIFICATION OF ANOMALOUS INCIDENTS BY SPACECRAFT 
SUBSYSTEM AND FUNCTION, THIS SAMPLE 


Subsystem Function 

Number of 
Functions 
In Sample 

Number of 
Reported 
Anomalies 
by Function 

Anomalies 
per Function 

TIMING, CONTROL, 

43 


88 


2.05 


AND c6mKAN6 







I. Receiving 


43 


28 


0.65 

2. Decoding 


37 


4 


0.11 

3. Command Distribution 


20 


11 


0.55 

4. Sequencing and 


21 


27 


1.29 

Programming 







5. Timing 


24 


11 


0.46 

6. Manual Control 


-- 


m m 


m ^ 

7. Unknown 


«i. m 


6 


m mm 

8. Unassignable 


mm 


1 


mm mm 

TELEMETRY AND DATA 

41 


161 


3.93 


MUM” ” 







1. Data Point Sensing 


10 


29 


2.90 

and Monitoring 







2. Signal Conditioning 


6 


3 


0.50 

3. Encoding, Formatting 


38 


10 


0. 26 

4. Data Storage 


34 


55 


1.62 

5. Transmission 


39 


59 


1 . 51 

6. Unknown 


-- 


1 



7. Unassignable 




4 


m m 

POWER 

45 


68 


1.51 


1 . Conversion 


45 


16 


0.36 

2. Storage 


41 


30 


0.73 

3. Power Control 


43 


13 


0.30 

4. Power Distribution 


38 


4 


0.11 

S. Unknown 


m 


5 


<■ m 

6. Unassignable 


m m 


m m 


mm 

ATTITUDE CONTROL AND 

42 


122 


2.90 


STABUwnw 







1. Orientation Sensing 


40 


58 


1.45 

2. Active Attitude 


30 


57 


1.90 

Correction 








EXHIBIT 4 - (Continued) 


I 

I 

I 

§ 

I 

I 

I 

I 

I 

I 

I 

I 


Number of 
Functions 


Number of 

Reported 

Anomalies 


Anomalies 


Subsystem Function 

In Sample 

by Function 

per Function 

3. Passive Stabilization 


24 


3 


0.13 

4. Unknown 




4 


— 

5. Unassignable 


-- 


— 


— 

d *. PROPULSION 

13 


31 


2.38 


1 . Navigation 


9 


3 


0.33 

2. Propulsion 


13 


27 


2.08 

3. Unknown 


— 


1 


— 

4. Unassignable 


-- 


— 



e . ENVIRONMENTAL CONTROL 

38 


7 


0.18 


1, Active Thermal Control 


22 


7 


0.32 

2. Life Support 


• 


-- 


— 

3. Unknown 


-- 


-- 


— 

4. Unassignable 


-- 


-- 


•- 

f . STRUCTURE 

45 


28 


0.62 


1. Basic Structure 


45 




• • 

2. Deployable Structure 


31 


27 


0.87 

3. Separation 


45 


1 


0.02 

4. Unknown 


-- 


— 


M M 

5. Unassignable 


— 


— 


m m 

a . PAYLOADS 

292 




1.01 


1. Scientific 


246 


249 


1.01 

2. Technological 


46 


45 


0.98 

3. Unknown 




mktm 


— 

4. Unassignable 


— 


MV 


M V 

h . UNKNOWN 








EXHIBIT 5 - DETAILED CLASSIFICATION OF ANOMALOUS INCIDENTS BY SPACECRAFT 
SUBSYSTEM AND FUNCTION, PRE-UPDATE SAMPLE 


Subsystem Function 

Number of 
Functions 
in Sample 

Number of 
Reported 
Anomalies 
by Function 

Anomalies 
per Function 

TIMING, CONTROL. AND 

222 


202 


0.91 


comHaNd 







1. Receiving 


218 


75 


0.34 

2. Decoding 


214 


19 


0.09 

3. Command Distribution 


52 


19 


0.37 

4. Sequencing and 


167 


36 


0.22 

Programming 







5. Timing 


157 


19 


0.12 

6. Manual Control 


11 


-- 


— 

7. Unknown 




23 


— 

8. Unassignable 


— 


11 


— 

TELEMETRY AND DATA 

236 


440 


1.86 


HANDLING 







1. Data Point Sensing and 


154 


177 


1.15 

Monitoring 







2. Signal Conditioning 


40 


— 



3. Encoding, Formatting 


226 


53 


0.23 

4. Data Storage 


92 


96 


1.04 

5. Transmission 


231 


92 


0.40 

6. Unknown 




14 



7. Unassignable 


— 


8 


— 

POWER 

237 


131 


0.55 


1, Conversion 


130 


24 


0.18 

2. Storage 


230 


47 


0.20 

3. Power Control 


204 


37 


0.10 

4. Power Distribution 


141 


8 


0.06 

5. Unknown 


m m 


13 


V 

6. Unassignable 


— 


2 


m tm 

ATTITUDE CONTROL AND 

202 


163 


0.81 


STABTHIATrON 







1. Orientation Sensing 


186 


73 


0.39 

2. Active Attitude 


179 


62 


0.35 


Correction 
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EXHIBIT 5 - (Continued) 



Subsystem Function 

Number of 
Functions 
in Sample 

Number of 
Reported 
Anomalies 
by Function 

/Romanes 
per Function 


3. 

Passive Stabilization 


45 


8 


0.18 


4, 

Unknown 


— 


12 


— 


5. 

Unassignable 


-- 


8 


-- 

d*. 

PROPULSION 

108 


31 


0.29 



1 . 

Navigation 


99 


8 


0.08 


2. 

Propulsion 


108 


10 


0.09 


3. 

Unknown 


— 


3 


— 


4. 

Unassignable 


-- 


10 


““ 

e. 

ENVIRONMENTAL CONTROL 

42 


29 


0.69 



1 . 

Active Thermal 


41 


17 


0.41 



Control 








2. 

Life Support 


12 


5 


0.42 


3. 

Unknown 


— 


2 


— 


4. 

Unassignable 


— 


5 


“ - 

f. 

STRUCTURE 

227 


19 


0.08 



1 . 

Basic Structure 


222 


2 


0.01 


2. 

Deployable Structure 


58 


6 


0.10 


3. 

Separation 


211 


10 


0.05 


4. 

Unknown 


-- 


1 




5. 

Unassignable 




— 



9. 

PAYLOADS 

517 


250 


0.48 



1 . 

Scientific 


465 


174 


0.37 


2. 

Technological 


52 


75 


1.44 


3. 

Unknovm 


-- 


1 


m ■» 


4. 

Unassignable 


m 


•t m 



h. 

UNKNOWN 

m 


36 


— 










Assignable causes are attributed to those anomalies that could 
have been prevented by some action taken before launch, within the state- 
of-the-art, If those responsible for the action were prescient. Anomalies 
due to postlaunch errors In spacecraft command and control are also cate- 
gorized as due to assignable causes. Four general areas can be Identified 
among the entries for which assignable causes exist. Their definitions 
are as follows: 

(1) Design: This area covers many anomalous behaviors 
such as RFI and sensitivity problems, unanticipated wearout or degradation 
as a result of time or known environmental conditions. The anomalies can 
be electrical, mechanical, thermal, or system-related. 

(2) Manufacture: This area includes parts or materials 
that are faulty due to some manufacturing problem, contamination, faulty 
solder joints or other connections, quality control, and the like. 

(3) Operation: Human error Is the prime reason for 
anomalies classified In this group. Errors Included Involve those asso- 
ciated with the spacecraft control function, usually by commanding, pro- 
granmlng, or calibrating the spacecraft. 

(4) Other: A miscellaneous classification, grouping 
together several areas such as meteoroid bombardment, anticipated wearout 
and secondary failures. 

Exhibit 6 shows the number of "assignable cause" entries In the 
four categories and the associated percentages for the successfully launched 
spacecraft In this sample. Exhibit 7 gives the same Information for the 
pre-update sample. Of all assignable causes, 68.6 percent were attributed 
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EXHIBIT 6 * DETAILED BREAKDOWN OF ANOMALOUS INCIDENTS BY ASSIGNABLE CAUSE. 
THIS SAMPLE 



Number 

Percent 

All Assignable Causes 

255 


100.0 


Design 

175 


68.6 


RFI, etc. 


38 


14.9 

System 


24 


9.4 

Electrical Components 


54 


21.2 

Mechanical 


24 


9.4 

Thermal 


27 


10.6 

Unanticipated Wearout or Degradation 


6 


2.3 

Launch Vibration and Shock 


2 


0.8 

Manufacture 

54 


21.2 


Fabrication. Q.C.. etc. 


19 


7.5 

Contamination 


15 


5.9 

Faulty Parts or Materials 


20 


7.8 


26 

0 


10.2 

0.0 


Operation 

Other 



'54* . 
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EXHIBIT 7 - DETAILED BREAKDOWN OF ANOMALOUS INCIDENTS BY ASSIGNABLE CAUSE. 
PRE-UPDATE SAMPLE 


Number Percent 


All Assignable Causes 

477 


100.0 


Design 

289 


60.6 


RFI, etc. 


82 


17.2 

System 


49 


10.3 

Electrical Components 


58 


12.1 

Mechanical 


28 


5.9 

Thermal 


32 


6.7 

Unanticipated Wearout or Degradation 


27 


5.7 

Launch Vibration and Shock 


13 


2.7 

Manufacture 

70 


14.7 


Fabrication. Q.C.. etc. 


34 


7.1 

Contamination 


21 


4.4 

Faulty Parts or Materials 


15 


3.2 

Operation 

41 


8.6 


Other 

77 


16.1 



a 

0 

ii 

11 

II 
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to Design In this update, 60.6 percent In the pre>update sample. In 
this sample 21.2 percent were attributed to Manufacture compared to 
14.7 percent In the pre update sample. Of assignable causes 10.2 per- 
cent were attributable to Operation In this update, 8.6 percent In the 
pre-update sample. There were no assignable causes In this update that 
were classified In the miscellaneous "Other” category; 16.1 percent of 
the pre-update assignable causes were In this category. 

As the exhibits Indicate, two of the four categories are further 
subdivided. The various subcategories under "Design" are as follows: 

(1) the subcategory "RFI, etc." Includes all anomalous Incidents attri- 
buted to Inadequate RFI design, noise sensitivity, and transients— 14.9 
percent of the assignable causes In this update belong to this category, 
and 17.2 percent of the pre-update assignable causes; (2) the three sub- 
categories "System," "Mechanical," "Thermal," Include Incidents arlsinn, 
respectively, from Inadequate design (a) In the spacecraft/environment or 
subsystem Interfaces, (b) In deployment, structural stiffness, or any 
moving mechanical parts, and (c) for proper spacecraft thermal balance; 
(3) the category "Electrical Component" refers to anomalies attributed to 
Inadequate design of a receiver, encoder, horizon sensor, or any elec- 
trical or electronic component— there are 21.2 percent update and 12.1 
percent pre-update assignable causes In this category; (4) "Unanticipated 
Uearout or Degradation" is attributed to anomalies where, for example, a 
battery sinqsly wears out before anticipated or where other components or 
parts do not have the Inherent capability to survive either the normal 
spacecraft environment or the expected life of the component or part; 
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(5) those anomalies classified "Launch Vibration and Shock" are attributed 
to designs Inauequate to survive the normal stresses a spacecraft under- 
goes during launch. There are only 0.8 percent update and 2.7 percent pre- 
update assignable causes In this category. 

Under "Manufacture" there are three subcategories. Included under 
"Fabrication, Q.C., ETC." are anomalies like cold or loose solder joints, 
loose conenctlons and missing parts. "Contamination" covers the relatively 
high occurrence of clogged lines, excess moisture, foreign matter In valves 
and the like— 5.9 percent update and 4.4 percent pre-update assignable 
causes fall In this category. "Faulty Parts or Materials" Indicates such 
Items as a faulty capacitor or degraded propellants caused by an Improper 
manufacturing process. All of these subcategories are mutually exclusive. 

4. Catastrophic Part Failures/Mission Effect . 

As Indicated earlier, there are 42 catastrophic piece part 
failures In the update data. These 42 anomalies are further analyzed here 
to provide Insights Into their effects on mission performance. 

To achieve the proper perspective, two detailed data breakdowns 
are required, 1) the extent of mission loss caused by part failures, and 
2) the proportions of part/non part related anomalies causing critical 
mission loss. In other words, the situation Is examined from two direc- 
tions. namely, both the extent and the role of part failures on mission 
loss. 

The following breakdown Indicates the extent, by number of 
anomalies and percentage, of mission loss caused by the 42 catastrophic 
piece part failures: 
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I 

i 

e 

I 

B 

B 

B 

B 

B 

B 

B 



Mission Effect 

Number 

Percent 

1. Negligible 

19 

45.2 

2. Non-Negllgible but 
Small 

17 

40.5 

3. 1/3 to 2/3 Mission 
Loss 

1 

2.4 

4. 2/3 to Nearly Total 
Mission Loss 

0 

0 

5. Essentially Total 
Mission Loss 

2 

4.8 

U. Unknown 

3 

7.1 


From the above breakdown, it can be seen that at least 85 percent 
of catastrophic piece part failures do not significantly impact the 
mission. Some of this may be due to the provision of redundancy. 

The second breakdown, provided below. Indicates the role of part/ 
non-part related anomalies In significant mission losses. The breakdown 
Is tabulated for 1/3 or greater mission losses (mission effect categories 
3, 4 and 5). In the update data, a total of 17 anomalies caused such 
losses, and the number and percentage of their distribution Is as follows: 


Incident Type 

Number 

Percent 

C. Catastrophic Part 
Failure 

3 

17.6 

0. Other Part-Related 
Failure 

4 

23.5 

N. Non-Part Related 
Failure 

4 

23.5 

U. Unknown 

6 

35.3 





.yv 


1 

4 
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This breakdown Indicates that of the missions Incurring substan-^ 
tial loss, catastrophic part failures were responsible 17.6 percent of 
the time. 

It Is to be emphasized that the results of these two breakdowns 
are not contradictory, but rather when taken together provide a possibly 
useful Insight Into the relationship of part failures and mission loss. 
That Is, while catastrophic part failures, per se, usually cause only 
minor loss, when a major loss does occur there Is a signlf cant probabi- 
lity that It will be due to a catastrophic part failure. 

5. Remarks . 

Note that besides the categorizations presented here and 
In previous sections, the reader can perform any of a large number of 
other classifications by using the raw data presented In Appendix A of 
this report. Also, more specific or detailed Information Is available by 
"querying" the data bank to obtain Information from the EAR'S on specific 
topics of Interest. 

f. CONCLUSIONS 

The e«q)has1s of this section, as well as the whole report. Is to 
present the total fund of data regarding Incidents of anomalous behavior 
reported on spacecraft. A few Interesting observations from the point of 
view of the authors are listed below. 

1. The vast majority of reported Incidents have little or 
no effect on the accomplishment of the spacecraft mission 
(see subsection II. C. 5). In this iq>date, 94.3 percent 
of the anomalies had small or negligible effect on mission 
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goals, and 89.5 percent of the anomalies In the pre-update 
sample had small or negligible eTfect. 

Of the 347 Incidents In this update for which It could be 
determined whether the anomaly was part or non-part 
caused, 110 (31.7 percent) were piece part-related, and 
42 (12.1 percent) were catastrohpic piece part failures. 

Of the 1,194 Incidents In the combined sample for which 
this determination could be made, 39.1 percent were piece 
part-related, and 18.8 percent were catastrophic piece part 
failures. 

Eighty-seven percent of the pre-update catastrophic part 
failures have small or negligible mission effect compared 
to 86 percent of the catastrophic part failures In th^s 
update. However, 12 percent of the major mission losses 
on this update were due to catastrophic part failures. 

Of the 966 Incidents In the combined sample where suffi- 
cient Information exists to distinguish between assignable 
and nonass Ignable Incident causes, over 73 percent fall 
Into the assignable category. These Incidents generally 
could have been prevented prior to launch by some action, 
well within the state-of-the-art (see Subsection II. C. 8). 
The 73 percent figure Is In close agreement with all 
earlier data samples. 

The tabulation below Indicates the five spacecraft 
functions with the highest anomaly rates In this update 
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and the pre-update sample. 


This Update 

. Data point sensing and 
monitoring 

, Propulsion 

Active attitude correction 
Data storage 
. Transmission 


Pre-Update 

. Technological experiments 

, Data Point sensing and 
monitoring 

. Data storage 

. Life support 

. Active thermal control 


6. The five spacecraft functions with the lowest anomaly 
rates In this update are: Basic structure, separation, 
power distribution, decoding, and passive stabilization 
(see Exhibit 4). This list is the same for the pre- 
update except that passive stabilization has replaced 
propulsion. It is surprising to note that propulsion, 
which had one of the lowest rates of anomalies per 
function in the pre-update sample, has one of the 
highest rates of anomalies per function In the update 
sample. 

7. The most common cause of spacecraft anomalies (when 
assignable) Is design (see Exhibits 6 and 7). This 
agrees with the conclusion reached In all previous 
studies. 










III. SPACECRAFT HARDWARE ELEMENT RELIABILITIES 


This section discusses numerical reliability factors for three levels 
of hardware elements; spacecraft subsystems, components, and piece-parts. 

Two reliability factors of prime interest may be readily derived from avail- 
able data. The first is the probability of hardware element failure during 
launch (q) and the second is the on-orbit hardware element failure rate (a). 
The derivation of these factors is first described, then the results are pre- 
sented. 


A. DERIVATION OF PARAMETER ESTIMATES 

If it is assumed that each identically named hardware element has 
an equal probability of failure during launch, irrespective of mission, 
then q may be readily estimated as 

q * - (1) 

N 


where i * number of hardware eler jnt failures during launch 
N = number of hardware elements in the sample. 

It has been shown repeatedly that, under very minimal constraints. 


R(t) - exp 


-/ 


X dt 


iZ) 


where x = hardware element failure rate 


t » survival time 


UilllD 
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In this formulation x may be any Integrable function of time. The pre- 
ponderance of reliability literature and practice assumes, however, that 
X Is constant, at least for most electronic hardware elements found In 
spacecraft. In this case Equation (2) assumes the more familiar form 

R(t) « exp( -xtj (3) 

In situations where Equation (3) applies. It Is also well known that 
the best estimate of x for a particular hardware element type Is given 

(4) 

2 s 

i = ’ 

where n » number of equivalent hardware elements under observation 
t^» survival time of the 1th such element 
and 

f » total number of failures observed. 


The formulation for determining confidence intervals for q and 
X are again well known and are given below for 90-percent Intervals: 


s q * 92 


where q Is such that 
I 


2 


i s I 




N-i 


15 ) 


S 0.05 




and q is such that 


where 


V /N\ i ,, ,N-i . 

' ( i / (I - q.) - 0.05 

^ — * \ I «» 


i 0 


\ , '.X ^ X , 


S,2i5 ^ 

n 

^ V t. 




V t 


If ? or f are zero, the above fonnulations give one-sided 95-percent 
confidence limits of the form 


0 < q < q 


0 < X < X 


Thus, the primary burden of this section is to derive estimates and 
confidence Intervals for the two parameters q and x. This is 
accomplished by first discussing the input data, its derivation and 




limitations. Then each of the three tiers of hardware level Is treated 

separately by derivlig the pertinent estimates and evaluating the results. 

« 

B. I NPUT DATA 

The basic compilation of data for each spacecraft In this study was 
performed precisely as for the previous three studies of on-orbit reliabil- 
ity data from spacecraft. Ihe procedure results In the generation of a 
working document called an Engineering Analysis Report (EAR). The details 
of the compilation process will not be repeated here.^ A brief synopsis of 
the procedure, however, will clarify the origin of the basic data used In 
this rectlon to derive estimates for the various parameters. 

Essentially, a key step In the compiling an EAR Is to determine and 
list components for a particular spacecraft that are of a sufficiently high 
level so that their operating history may be readily determined and yet are 
of a sufficiently low level so that It Is reasonable to assume that their 
normal operation would be precluded by the occurrence of a piece-part failure. 
The spacecraft subsystems to which these components are assigned are also 
listed as are the piece parts within each Identified component. From this 
data., subsystem, com(X)nent, and piece part operating histories are determined 
and pertinent time factors are computed. 

Component and piece-part failures are determined directly from the 
EARS. These failures are also a subset of entries contained In Appendix A 
and can also be determined directly therefixim. Subsystem failures are de- 
termined directly from the the entries of Appendix A, that Is, those anomalies 

Vor detailed description of the EAR, the reader Is referred to Appendix B, 





PRC R-1863 
53 



coded as being relevant to a particular subsystem and causing severe de- 
gradation to the mission (Misssion Effect severity levels 4 or 5) are con- 
sidered as being subsystem failures. 

In the determination of piece-part failures for estimating X (Equa- 
tion (3)), a failure is attributed to a piece part If, and only if. It is 
known to have failed In a catastrophic manner for no evident cause. This 
definition Is consistent with the definition of x as it Is utilized in Equa- 
tion (2). All such piece-part failures are coded with a C In Column VIB 
and an N In Column VII of the classification codes of Appendix A. In this 
update 19 such coded anomalies have been added to the data base. 

Failures are attributed to a component In the same manner, essentially 
by treating the entire component as If It were a big piece part. 

Parameter estimates are calculated for three data sets: (1) the pre- 
update sample. (2) the ('ita obtained In this sample, and (3) the combined 
sample. Exhibits 8, 9, and 10 tabulate the subsystems, components, and 
parts considered in this section of the study together with their total pop- 
ulation, the number falling during launch, their cumulative survival hours 
and the number falling during orbital operation. 

Two points should be noted with respect to the survival hours shown 
In these exhibits. First, these are the cumulative survival hours contalne. 
In the data bank for each of the various hardware elements, and are not to 
be confused with failure rates. Second, the survival hours vary among ele- 
ments from quite high to relatively low. This occurs for several reasons. 
In some cases It Is due to the populations of the elements under considera- 
tion being quite large or relatively small. In other cases, the elements 
that were used to a greater extent on short term missions did not accumu- 




EXHIBIT 8 - SPACECRAFT HARDHARE ELEMENT SURVIVAL AND FAILURE STATISTICS 
BASED ON PRE-UPDATE SAMPLE 



EXHIBIT 8 . (Contlnutd) 








EXHIBIT 9 - SPACECIiAFT HAROUARE ELEHENT SURVIVAL ASD FAILURE STATISTICS 
BASED ON DATA OF THIS SAMPLE 
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late as iiany survival hours as elements used extensively on long term missions. 
Also, elements experiencing a large number of failures would obviously accu- 
mulate fewer survival hours than elements with a history of continued, satis- 
factory operation. 

Exhibit 8 presents the basic data tabulation of the pre-update sample. 
Exhibit 9 presents a similar tabulation for the sample of this study. Ex- 
hibit 10 contains the tabulation for the combined sample. 

The spacecraft samples of the previous reliability reports and this 
report are not independent. Five spacecraft in this sample also appeared 
in the earlier studies. These spacecraft were launched prior to 1970 
and have continued to operate into the time period of this study. It 
is for this reason that the data for these five spacedraft have been up- 
dated and included in this study. Thus, corresponding entries in Exhibits 
8 and 9 do not necessarily add to give the corresponding entry in Exhibit 
10. Though the samples are net entirely independent, the method of present- 
ing the data allows examination of the basic data elements by three 
time periods: spacecraft launched in the interval 1958 to 1970 (12 years), 
those launched in the interval 1970 to mid-1977 (7^ years) and the total 
sample, covering nearly 20 years. 

The main rule in constructing Exhibits 8, 9, and 10 was to enter only 
known values. For example, as Exhibit 10 indicates there are 354 re- 
ceivers in the com'ined sample for which operational histories are com- 
plete; ciflnulatively these components survived at least 5.8 million hours 
and exhibited at least two launch failures and five orbital failures. 

If is known that the figures are higher than those presented, but it is 
not known by how much. This results from Incompleteness of the historical 
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data for somt; of the spacecraft In the data sample^ and does lead to dif- 
ficulty in interpreting the resultant estimates of q and X . Further 
discussion of the interpretation difficulty is discussed in later subsec- 
tions where each hardware tier is treated in detail. 

Exhibits 8, 9, and 10, then, present the basic data and form the 
basis of the analyses performed in the subsequent subsections. Interpre- 
tation and conclusions are, of course, influenced by the total knowledge 
acquired in the course of the study. 

C. SUBSYSTEM ANALYSIS 

For this study, the eight spacecraft subsystems are defined 
exactly as they were in all earlier studies. In point of fact, each pro- 
gram and often different vehicles in the same program use a different in- 
ternal subsystem description. The expedient of relating subfunctions 
of each spacecraft to a set of previously defined subsystems in a mu- 
tually exclusive and exhaustive manner not only provides for ease in 
data compilation across variously-named subsystems but also accomplishes 
two other important goals. First, it allows the anomalous incidents to 
be assigned to one and only one functional location within the spacecraft. 
Second, it avoids listing recognizable subsystems, i.e., those traceable 
to a specific program. It is quite clear that this procedure introduces 
a substantial degree of heterogeneity into the eight subsystem categories 
thus defined. Nevertheless, for large system planning considerations, 

T 

As previously noted, the completeness of historical data for the sample 
of this study was superior to that of earlier studies. 
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some indication of gross* average launch failure probabilities (q) and 
on-orbit failure rates for spacecraft subsystems (x) might be useful. 

Exhibit 11 presents the best estimates and confidence limits for 
q and X for the earlier studies. Exhibit 12 presents the same infor- 
mation for the spacecraft of this study; Exhibit 13, for the combined 
data sample. 

It should be borne in mind when using or studying the three ex- 
hibits for estimates of the subsystem parameters that a subsystem failure 
is defined as some anomalous incident associated with the subsystem, the 
result of which is to reduce mission effectiveness by at least 2/3 of its 
potential effectiveness. The parameters as given are felt to be reason- 
ably indicative of failure propensities of spacecraft subsystems. 


fi 

I 

0 

s 


0. CO MPONENT ANALYSIS 

The components listed in Exhibits 8, 9, and 10 display a wide 
variation in both number of items in each sample and in ninnber of sur- 
vival hours. This situation reflects both variation in absolute component 
population as discussed earlier, and in the input data. Some of the 
entries may appear to be insignificant. The intent in providing the 
entries is to add to other data that may be available to the reader 
rather than to provide meaningful estimates of reliability parameters. 

As indicated previously, only known values are included. 

The best estimates and the 90-percent confidence intervals for q 
(the probability of failure during launch) for components having one or 
more failures during the launch phase are given In Exhibits 14 and 15. 
Since none of the components in this update experienced a launch failure 
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EXHIBIT n - SPACECRAFT SUBSYSTEM RELIABILITY PARAMETER ESTIMATES AND 
90-PERCENT CONFIDENCE INTERVALS BASED ON PRE-UPDATE SAMPLE 


Spacecraft Subsystems 

Timing* Control, and 
Command 

Telemetry and Data 
Handling 

Power 

Attitude Control and 
Stabilization 

Propulsion 

Environmental Control 

Structure 

Payload 


Probability of Failure 


During Launch 


‘^l 


^2 

0.0060 

0.018 

0.040 

0 

- 

0.0094 

0.0056 

0.016 

0.038 

0.0067 

0.020 

0.045 

0.0074 

0.027 

0.070 

0 

- 

0.074 

0,0058 

0.016 

0.037 

0.0042 

0.012 

0.028 


On-Orbit Failure Rate 
(Failures/Million Hours) 


^1 

A 

A 

^2 

0.75 

2.2 

5.0 

0.19 

1.1 

3.3 

4.2 

7.0 

11 

3.6 

6.9 

12 

0 

- 

4.6 

0 

- 

1 .1 

0.028 

0-54 

2.6 


Note : Upper and lower 90% confidence bounds are indicated as q, and 
qp for the probability of failure during launch, and by A, and 
Ag for the on-orbit failure rates. 
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EXHIBIT 12 - 


SPACECRAFT SUBSYSTEM RELIABILITY PARAMETER ESTIMATES AND 
90-PERCENT CONFIDENCE INTERVALS FOR THIS SAMPLE 


Spacecraft Subsystems 


Timing, Control and Command 


Telemetry and Data Handling 


Power 


Attitude Control and 
Stabilization 


Propulsion 


Environmental Control 


Structure 


Payload 


Probability of Failure 
During Launch 



On-Orbit Failure Rate 
(Failures/Ml 11 ion Hours) 




m 
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EXHIBIT 13 - SPACECRAFT SUBSYSTEM RELIABILITY PARAMETER ESTIMATES AND 
90-PERCENT CONFIDENCE INTERVALS FOR COMBINED SAMPLE 


Probability of Failure 


In-Orbit Failure Rate 


■ Spacecraft 

Subsystems 

!i 

q 



X 


H Timing, Control 

and Command 

0,005 

0.015 

0.034 

0.47 

1.4 

3.1 

1 

■* Telemetry and Data 

Handling 

1 

0 

- 

0.010 

0.31 

1.1 

2.9 

i 

Power 

0.0048 

0.014 

0,033 

4.5 

7.4 

12.0 

H 

Attitude Control 
_ and Stabilization 

I 

0.0051 

0.015 

0.035 

1.8 

3.5 

6.0 

H 

Propulsion 

i 

0.0061 

0.023 

0.058 

0 

- 

8.2 

B 

Environmental 
g Control 

0 

- 

0.057 

0 

m 

3.0 

B 

structure 

I 

0.0049 

0.014 

0.033 

0 

- 

1.1 

m 

Payload 

1 

0.0037 

0.011 

0.025 

0.11 

0.61 

1.9 
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EXHIBIT 14 - PROBABILITY OF FAILURE DURING LAUNCH AND 90-PERCENT 

CONFIDENCE INTERVALS FOR SELECTED SPACECRAFT COMPONENTS 
BASED ON PRE-UPDATE SAMPLE 


Probability of Failure During Launch 


Component 

‘’1 

q 

‘»2 

DC/ DC Converters 

0.00027 

0.0052 

0.024 

Heaters 

O.OOOIE 

0.0029 

0.011 

Horizon Sensors 

0.00043 

0.0083 

0.039 

Prograniners 

0.00089 

0.017 

0.082 

Receivers 

0.0013 

0.0071 

0.022 

Sequencers 

0.0029 

0.016 

0.051 

Sun Sensors 

0.00053 

0.010 

0.049 

Timers and Clocks 

0.00024 

0.0046 

0.022 

Voltage Controlled 

0.00077 

0.015 

0.071 


Oscillators 
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EXHIBIT 15 - PROBABILITY OF FAILURE DURING LAUNCH AND 90-PERCENT CONFIDENCE 
INTERVALS FOR SELECTED SPACECRAFT COMPONENTS FOR THE COMBINED 
SAMPLE 




«- 4 

V 

V* 

; 

«*N 

4 



Probability of Failure During Launch 

Component 


A 

q 

92 

DC/DC Converters 

0.00018 

0.0034 

0.016 

Heaters 

0.00013 

0.0026 

0.012 

Horizon Sensors 

0.00032 

0.0062 

0.029 

Programmers 

0.00066 

0.013 

0.060 

Receivers 

0.00010 

0.0056 

0.018 

Sequencers 

0.0027 

0.015 

0.048 

Sun Sensors 

0.00033 

0.0064 

0.030 

Timers and Clocks 

0.00020 

0.0039 

0.018 

Voltaqe Controlled 
Oscillators 

0.00070 

0.014 

0.064 



^ , 
.1 

ii| 



f 

* 


t* 









IP** 
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(see Exhibit 9), no estimates of q are provided. 

Exhibits 16, 17, and 18 present tne estimates of ^ for the 
selected components of the three data samples. 

Generally, there are not enough knovm failures to reach a reason* 
able degree of statistical stability. Note that In the combined sample 
only one component has three launch failures, tMO have two launch fall* 
ures, and the rest have either zero or one. The width of the confidence 
Intervals shown In Exhibit 15 are Indicative of the meager failure data. 
The on-orbit failure rates, as shown In Exhibit 18, are slightly more 
stable. Ten components In the combined sample have five or more fail- 
ures. 

^ • P IECE -PART ANALYS IS 

As with the component analysis, stress was placed on using only 
data for piece parts that are known or can be reasonably assumed. Many 
more assumptions are required at the piece-part level with regard to op- 
erating hours since telemetry data simply Is Insufficient to describe the 
operational history of many specific piece parts In a given spacecraft. 

It will be recalled that an operating assumption of this study Is that as 
long as a component Is completely operable, so is every piece part within 
the component. When a component exhibits anomalous behavior, the piece 
parts are removed from the sample If there Is any suspicion that the 
anomaly was caused by a piece part. The result Is that the hours listed 
In Exhibits 8, 9, and 10, represent minimum part-hours within the limits 
of the Input data. 
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EXHIBIT 16 - ON-ORBIT FAILURE RATE ESTIMATES AND 90-PERCENT CONFIDENCE 
INTERVALS FOR SELECTED SPACECRAFT COMPONENTS BASED ON PRE- 
UPDATE SAMPLE 


On-Orbit Failure Rate 
(Failures/Million Hours ) 



^1 

X 


Batteries 

1.0 

2.2 

4.2 

Decoders 

0.024 

0.39 

1.9 

Conmand Distribution Units 

0.50 

2.8 

8.9 

Comp ters 

1.1 

21 

98 

DC/DC Converters 

0.57 

2.1 

5.3 

Heaters 

0.019 

0.36 

1.7 

Horizon Sensors 

6.1 

18 

41 

Magnetic Tape Units 

27 

35 

45 

Motors 

0.28 

1.0 

2.6 

Oscillators 

0.021 

0.42 

2.0 

Receivers 

0.12 

0.68 

2.1 

Regulators, Pressure 

0.14 

2.7 

13 

Regulators, Voltage 

0.26 

0.77 

1.8 

Telemetf’y Encoders 

4.2 

8.5 

15 

Timers and Clocks 

2.6 

4.7 

8.0 

Transmitters 

1.8 

3.0 

4.8 

Transponders 

1.1 

6.3 

20 

Vidicon Cameras 

3.3 

7.5 

15 
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rXHIBIT 17 - ON-ORBIT FAILURE RATE ESTIMATES AND 90-PERCENT CONFIDENCE 
INTERVALS FOR SELECTED SPACECRAFT COMPONENTS BASED ON THIS 
SAMPLE 

On-Orbit Failure Rate (Failures/Million Hours) 

Component 


A 

k 


Accelerometers 

0.10 

2.0 

9.5 

Amplifiers, (1) 

0.033 

0.64 

3.0 

Battery Charge/Oiscbargp 

0.020 

0.77 

1.8 

Control Circuits 




Battery Pav.';s 

0.015 

0.29 

1.4 

Control Gas Assemblies 

0.55 

3.1 

9.7 

Data Handling U.iits 

0.067 

1.3 

6.2 

Gyros 

0.076 

1.5 

7.0 

Magnetic Se. .ing Devices 

0.097 

1.9 

9.0 

Magnetic Tap<; Units 

4.9 

9.0 

16.0 

Magnetometers 

0.067 

3.7 

11.0 

Radiometers 

6.2 

11.0 

19.0 

Receivers 

0.025 

0.92 

2.4 

Regulators, Voltage 

0.021 

0.41 

2.0 

Signal Conditioners 

0.19 

3.7 

18.0 

Sun Sensors 

0.33 

1.9 

4.4 

Star Trackers 

1.5 

8.2 

19.0 

Transmitters, S-Band 

0.65 

3.7 

12.0 

Transmitters, other (2) 

0.13 

0.92 

2.9 

(1) These amplifiers do 

not include power amplifiers. 


(2) These transmitters 

are other 

than: beacon transmitters. 

Doppler trans 


mitters, FM transmitters, S-Band transmitters, special purpose transmitters, 
tracking transmitters, wideband transmitters, or video transmitters. 


!J 

iJ 

I! 

II 

1] 

11 

11 
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EXHIBIT 18 - ON-ORBIT FAILURE RATE ESTIMATES AND 90-PERCENT CONFIDENCE 


INTERVALS FOR 
SAMPLE 

SELECTED SPACECRAFT COMPONENTS 

BASED ON COMBINED 


On-Orbit 

Failure Rate (Fallures/Mlll Ion Hours) 

Comf^onents 

h. 

* 

X 

^2 

Accelerometers 

0.08 

1.6 

7.7 

Amplifiers, (1) 

0.0063 

0.12 

0.58 

Battery Charge/Discharge 
Control Circuits 

0.012 

0.23 

1.1 

Battery Packs 

0.62 

1.3 

2.3 

Command Decoders 

0.014 

0.26 

1.25 

Conmand Distribution 
Units 

0.31 

1.8 

6.6 

Computers 

0.012 

2.3 

11.0 

Control Gas Assemblies 

0.65 

3.1 

9.7 

Data Handling Units 

0.030 

0.59 

2.8 

DC/DC Converters 

0.022 

0.84 

2.2 

Gyros 

0.29 

1.7 

5.2 

Heaters 

0.012 

0.23 

1.1 

Magnetic Sensing Devices 

0.097 

1.9 

9.0 

Magti.vic Tape Units 

14.0 

24.0 

37.0 

Magnetometers 

0.29 

2.6 

5.2 

Momentum Wheel/Reaction 
Wheel Assemblies 

2.1 

3.3 

11.0 

Oscillators 

0.019 

0.36 

1.7 

Radiometers 

6.1 

11.0 

18.0 

Receivers 

0.34 

0.86 

1.8 

Regulators, pressure 

0.021 

0.40 

1.9 

Regulators, voltage 

0.30 

0.75 

1.6 

Signal Conditioners 

0.06.3 

1.2 

5.8 
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EXHIBIT 18 - (Continued) 


Cn-Orbit Failure Rate (Failures/Million Hours ) 

: Xo 


Sun Sensors 

0.33 

1.2 


Star Tracker 

33.0 

57.0 

90.0 

Telemetry Encoders 

1.6 

3.2 

5.8 i 

Timers and Clocks 

1.4 

2.6 

4.3 m 

Transmitters, S-Band 

1.2 

4.4 

11.0 ^ 

Transmitters, Special 
Purpose 

0.14 

2.8 

13.0 ^ 

Transmitters, Wideband 

1.4 

5.0 

14.0 1 

fransmi tters. Video 

2.5 

9.2 

24.0 

Transmitters, other (2) 

1.4 

2.3 

1 

Transponders 

0.45 

2.5 

8.0 

Vidicon Cameras 

2.2 

5.1 

10.0 B 


(1) These amplifiers do not include power amplifiers. 

(2) These transmitters are other than: beacon transmitters, Doppler 
transmitters, FM transmitters, S-Band transmitters, special 
purpose transmitters, tracking transmi tters , wideband transmitters, 
or video transmitters. 


m ■ 
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The column indicating number of failures also represents the 
minimian number of part failures. A failure is entered in Exhibits 8, 9, 
and 10 only if the part has failed catastrophically for no evident cause. 
The number of part failures is lower than the true value for at least the 
following reasons: (1) some part failures are never detected due to 

minimal effect, low-level redundancy, etc., (2) soine detected part fail- 
ures are not reported, an Inevitable situation where no formal procedure 
exists for such reporting, (3) some anomalies strongly suspected as orig- 
inating from a part failure simply cannot be isolated to the particular 
part, and (4) many anomalous behaviors are noted for which it is simply 
unknown whether or not a piece-part failure is involved. 

Tht5 all the reliability statistics derived in this subsection 
are felt to be somewhat low compared to the true piece-part failure rates 
in space. To overcome this bias, however, it is judged that an order- 
of-magnitude increase in all the failure rates and failure probabilities 
in this subsection would be more than sufficient. 

Exhibits 19, 20, and 21 present the on-orbit failure rates for 

piece parts exhibiting one or more failures. No table for probability 

of failure during launch was generated. Only five piece parts incurred 

failures in this phase, one for each part. These part types and their 

corresponding estimates of q are: 

Piece Part q 

Capacitor 3.7 x lO’c 

Relays 8.0 x 10? 

Switches 5.8 X lO”- 

Transducers 1.9 x 10"^ 

Transistors 4.9 x 10‘» 
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EXHIBIT 19 - ON-ORBIT FAILURE RATE ESTIMATES AND 90-P£RCENT CONFIDENCE 
INTERVALS FOR SELECTED PIECE-PARTS BASED ON PRE-UPDATE 
SAMPLE 


On-Orbit Failure Rate 
(Failures/Million Hours) 



^1 

X 

^2 

Battery Cells 

0.00087 

0.017 

0.080 

Capacitors 

0.00051 

0.00094 

0.0016 

Diodes 

0.00035 

0.0010 

0.0024 

Fuses 

0.064 

0.23 

0.61 

Integrated ''ircuits 

0.0022 

0.0065 

0.015 

Relays 

C. 00044 

0.0085 

0.040 

Resistors 

0.0000090 

0.00018 

0.00083 

Solet.oids 

0.028 

0.55 

2.6 

Swi tches 

0.15 

0.43 

0.99 

Thermistors 

0.12 

0.27 

0.54 

Transistors 

0.00020 

0.0011 

0.0035 

Traveling Wave Tubes 

0.091 

1.8 

8.4 

Tubes, Special Purpose 

0.31 

6.0 

29 

Geiger Mueller Tubes 

5.4 

16 

36 

Photomultiplier Tubes 

0.24 

4.7 

22 
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EXHIBIT 20 - ON-ORBIT FAILURE RATE ESTIMATES AND 90-PERCENT CONFIDENCE 
INTERVALS FOR SELECTED PIECE-PARTS BASED ON THIS SAMPLE 


On-Orbit Failure Rate (Fallures/Million Hours ) 


Piece Part 


A 


Battery Tells 

0.013 

0.075 

0.23 

Capacitors 

0.00019 

0.0011 

0.0033 

Diodes 

0.00012 

0.00067 

0.0021 

Fuses 

0.0080 

0.045 

0.14 

Integrated Circuits 

0.000034 

0.00066 

0.0042 

Swi tches 

0.020 

0.40 

1.9 

Transistors 

0.00029 

0.0016 

0.0051 

Tubes, General Purpose 

0.27 

1.0 

2.6 



1863 

81 


PRC R-1863 
82 


li.. Jl«<aga ^laaf 'htaai ,m!’..iaaAja Ja 


tXHIBIT 21 - ON-ORBIT FAILURE RATE ESTIMATES AND 90-PERCENT CONFIDENCE 
INTERVALS FOR SELECTED PIECE-PARTS BASED ON COMBINED 
SAMPLE 


On-Orbit Failure Rate (Failures/Million Hours) 


Piece Parts 


Battery Cells 

0.010 

0.037 

Capacitors 

0.00057 

0.0010 

Diodes 

0.00042 

0.00097 

Fuses 

0.036 

0.090 

Integrated Circuits 

0.00099 

0.0025 

Relays 

0.00031 

0.0061 

Swi tches 

0.18 

0.47 

Thermistors 

0.053 

0.12 

Transistors 

0.00050 

0.0015 

lubes. General Purpose 

0.15 

0.55 

Tubes, Special Purpose 

0.23 

4.39 

Geiger Mueller Tubes 

5.4 

16.0 

Photomultiplier Tubes 

0.24 

4.6 
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F- MISCELLANEOUS STUDY FINDINGS 

This section discusses six observations of Interest that do not 
fit In the fonnallzed analyses of the previous subsections. Other study 
findings of this nature but Involving more detail are presented in the 
six Experience Bulletins, as described in Section IV. 

It should be noted that these observations are typical of the 
types of specific findings that can be obtained from data bank analyses. 
Depending on the depth of detail desired, the analyses can be based on 
the raw data presented In Appendix A, or on data from th^ EAR‘s. The ob- 
servations discussed below should be of general Interest. Other observ- 
ations or findings can, of course, be otalned In response to specific 
queries or needs. 

(1) Redundancy: As found In the three previous dat? bank 

studies, redundancy played an Important role In reducing 
the effects of an anomaly. There are 45 Instances In this 
update where "block" redundancy prevented a more serious 
effect. There are also 68 more Instances where the ser- 
iousness of the anomaly was alleviated by "backup" other 
than block redundancy. Such backup, which was most often 
possible on the more complex spacecraft, consisted of 
either an alternate means of accomplishing the same func- 
tion or "work around" procedures developed for ground 
control . 


ms 



Self-Healing: The apparent self-healing capability 

which has been noted In previous data bank studies was 
again observed. In the update sample, there were 34 
Instances of anomalous behavior that cleared up without 
any type of inte.-ventlon. 

Aging/Wearout: As Indicated In previous data bank reports, 
aging/wearout does not appear to be a problem. Six In- 
stances are reported In this update, with two of them 
Involving radiometers and one each a battery, a star 
tracker, a tube filament, and a plasma experiment package. 
Ground/Operator Errors: Anomalies In this category have 
not been observed to any significant degree In the past 
data bank studies. Due In part to the more complex space- 
craft Included In this update, 30 Instances are reported 
involving ground/operator error, and another five are 
reported Involving ground software. 

Intermittent/Degraded Operation Prior to Failure: There 
have been anomalies Involving Intermittent or degraded 
operation prior to "falling solid” In all previous data 
bank samples, but they were not previously tabulated. 

In the update sample, 17 such Instances are reported. 
Test-Related Anomalies: In the update sample, there are 
30 anomalies that are known to be related In some fashion 
to the testing program. There are undoubtedly other anom- 
alies of this type In the update data, but specific infor> 
mation is given only for the 30. 
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These 30 anomalies can be classified as follows: 

• 11 anomalies were known to exist prior to launch 

• 3 anomalies existed prior to launch but were undetected 

t 8 anomalies had also been seen In test 

• 6 anomalies were attributed to Inadequate testing or test 
procedures 

t 2 anomalies were attributed to damage caused by testing 
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IV. SPECIAL STUDIES 

In each of the four data collection efforts, with the exception 
of the third, a special study or two was requested by the contracting 
agency. In this update six experience bull .Ins were requested to en- 
courage higher reliability, more consistent performance, reduction In 
human errors, and reduced cost In NASA projects. Special studies re- 
garding dormancy and the relationship of program success to quality as- 
surance factors were also requested. The latter element was treated In 
the first collection as well. The second data collection effort briefly 
treated dormancy and on/off cycling. The results of these studies are 
presented In this section. Subsection A deals with the question of dor- 
mancy, and presents data at the spacecraft, component, and piece-part 
level. Subsection B presents previously derived results relating to on/ 
off cycling.^ Subsection C treats the relationship of reliability and 
quality assurance to spacecraft mission success. Subsection 0 briefly 
sunmarlzes the most cogent findings of the six experience bulletins. 

All of these special studies depend on the preceding sections 
of this report, the basic engineering analysis reports (EARs) for the 
various programs, and, to a lesser extent, the basic doomentatlon as- 
sembled for this study. These special studies are Indicative, there- 
fore, of the Information which Inheres In the entire space data bank both 

'As Indicated In the Introduction to this report, there have been several 
Independent analyses of the data bank and these are reported separately 
(References 4, 5, 6, 10, 11, 13, and 14); only those analyses performed 
In conjunction with a collection effort are Included In this section. . . 
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with respect to its positive attributes and its limitations. By the very 
nature of the study, there tends to be some information applicable to 
nearly any relevant question or problen area, but for only a very few 
questions may large quantities of data be anticipated. Not unexpectedly, 
the more specific and narrowly focused the question or subject area, the 
scarcer the directly applicable data become. 

A. DORMANCY 

Reliability data on dormancy and standby operation of spacecraft 
components has been collected and analyze*^ in all four collection efforts 
associated with the space data bank. Until this update, however, no com- 
pilation of dormancy Information at the large equipment group or space- 
craft level was possible. As described in the following subsection that 
situation has changed and profiles of several spacecraft are available 
which include long periods of dormancy. The traditional component and 
piece-part dormancy analysis is provided in Subsection IV. A. 2 below. 

1. Spacecraft 

Significant periods of dormancy were - 'ated b./ nine 

spacecraft in this update. The spacecraft are: SER'* il, iO-S, '’iOS-2, 
Mariner 10, SAS-B, LANDSAT 1. SMS-1 and 2, and GOES-1. The pa icy as- 
sociated with these spacecraft involved the entire spacecrw t 4 cases 
and dormancy of major equipment groups in five cases. Exc«;)c for short 
periods of operation and checkout twice a year, SERT-II has been essentially 





dormant for over six years. GEOS-2 was reactivated and checked out after 
a non-operatlonal period of almost two-and-one-half years. OSO-5 and SAS-B 
were reactivated and checked out after about one-ano-cne-half years of 
dormancy. 

It is of interest that tne dormancy information available in the 
update data revealed no reliability problems that could be attributed to 
dormancy. Only one anomaly was reported to have occurred during a dor- 
mant period; the failure of a battery on SERT-II. Since this battery 
had operated beyond Its expected life at thal point, there appears to be 
no relationship between this failure and the effects of dormancy. 

a. SERT II 

SERT II was launched In February 1970 and carried 
two Ion thrusters as Its major payload. Thrustor i failed after flve- 
and-one-half months In orbit, and Thruster 2 after three months. In both 
cases, thruster operation was terminated due to a high-voltage short across 
the thruster grids. Since thruster restart was still possible, a series 
of tum-on tests were conducted In 1971 In an attempt to clear these shorts. 
These tests were unsuccessful and the spacecraft was placed In a storage 
mode. 

By 1973, proposed electric propulsion missions Included a need to 
restart thrusters many times. Therefore, the storod SERT- II spacecraft 
was re-activated (even though well beyond Its one year design life) to 
demonstrate multiple restart capability and to conduct various other 
evaluations of thruster components. 
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During this 1973 reactivation, each thruster was successfully re- 
started 112 times. In addition, the basic subsystems provided the n'qulred 
support. The 1973 test program was terminated due to other priorities 
for the ground-support equipment. 

By 1973, SERT-II's orbit had processed such that the sun angle 
was oblique and inadequate sr^c'.raft power was predicted for 1974. 
Therefore, at the end of the 1973 test program, maneuvers were executed 
to obtain a new spacecraft orientation for testing in the 1974 to 1976 
period. 

In August 1974, SERT-II was again reactivated. During these 1974 
tests, the high-voltage short on Thruster 2 was cleared, returning it to 
normal operation. Multiple restart tests of both thrusters were also con- 
ducted, as well as tests of spacecraft electrical potential control via 
the neutraliser cathode. The spacecraft was shut down September 29, 1974. 

During 1975, the spacecraft was turned on and the basic subsys- 
tems checked out in the spring and again during November and December, 
when the thrusters were also tested. Beginning in 1974, this has become 
the established pattern. That is, the spacecraft is checked out and 
the thrusters fired during the fall/winter period when array power is 
adequate for thruster firing. About midway between the annual thruster 
firing the spacecraft is activated and the basic subsystems checked out. 

A key activity occurring during the spring operation Is the respinning 
of the spacecraft with the gas attitude adjustment system. It was dis- 
covered that SERT-II despins due to some unexplained phenomenom and must 
be respun every six months or so to maintain its spin-stabilization. 
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This data base update includes data through the reactivation in 
August of 1976. At that time, all major subsystens remained functional. 

It is also known that SERT-II was reactivated in 1978 and that all major 
subsystems remaired functional. 

Only one anomaly— failure of a battery— is reported to have occurred 
during any SERT-II dormancy period. This battery was a 40 ampere-hour 
silver oxide-zinc battery of the type that had been used on the Mariner 
program. The battery was reported to be capable of at least five discharge 
cycles. 

The battery was found to be dead (failed) at the end of the first 
dormant period. The battery charger was turned off at this point. 

The battery is reported to have operated beyond its expected life 
prior to the first spacecraft shut down. Therefore, it seems doubtful that 
dormancy conditions are in any way related to the battery failure. 

The other anomalies on SERT-II occurred during operational periods. 
They are all of the type routinely observed in data bank evaluations of 
operational spacecraft, and again seem completely unrelated to dormancy. 

The SERT-II gas attitude adjustment system seems of special Interest 
In dormancy considerations. It was Intended, and indeed originally 
called, the backup reacquisition control system (BAGS). It Is quite sim- 
ilar to the systems used In Surveyor. It has been used three times for 
reorientation maneuvers with the last of these maneuvers being In August 
of 1976. Except for these brief periods of operation (i.e., a few 
moments each) this system has been In a dormant state since the spacecraft 
was launched. There are no reported anomalies chargeable to this system. 






The fifth Orbiting Solar Observatory (OSO-5) was 
turned off December 31, 1972 so that its transmissions would not inter- 
fere with the newer OSO-7. OSO-5 was reactivated early in July 1974 when 
OSO-7 reentered the earth's atmosphere. Thus, OSO-5 was dormant for about 
a year-and-a-half (546 days). While anomaly data are not available in the 
data bank for this dormant period, it is known that the basic subsystems 
remained capable of supporting the mission. 

The following experiments were operable July 25, 1974: 

0 Solar X-Ray Spectroheliograph 

0 Zodiacal Light Monitor 

0 Solar Lyman Alpha Telescope 

c. GEOS-2 

When the GEOS-3 spacecraft became operational in 
April 1975, the GEOS-2 experiments were no longer needed and they were 
all turned off. The laser tracking reflector experiment, a passive device, 
continued to be used by ground stations. The basic spacecraft continued 
to be monitored and -a telemetry readout was taken about twice a week. 

In the fall of 1977 it was proposed that this minimal monitoring 
be stopped and the spacecraft "turned off" completely, About this same 
time it was reported that the laser tracking had become unusable and there- 
fore the decision wis made to deactivate GEOS-2. It was also decided to 
activate and check the status of as many experiments as possible prior to 
the spacecraft shut down. Unfortunately, the necessary ground equipment 



PRC R-1863 
93 



r: 


L_i: LLi » M :i 


L;r:i:. i: 




I 


associated with several experiments had oeen scrapped and only the Doppler 
Beicons and the C>band transponders could be activated. Both experiments 
were found to be In good condition and opera le. At that time, these 
experiments had been dormant for 28 months, 

d. Mariner 10 

The Mariner 10 ultraviolet spectrometer and in- 
frared radiometer experiments, as well as the TV subsystem, were turned 
off (dormant) for major periods of time during the mission. In addition, 
one redundant radio frequency subsystem exciter and one redundant portion 
of the modulation/demodulation subsystem were turned off at any given 
time during the mission. There were no part failures experienced in 
those equipments during the time they were turned on or off. 

e. SAS-B 

The SAS-B gamma-ray telescope experiment failed 
early in the mission. Since this was the only experiment carried by 
SAS-B, the spacecraft was deactivated and then used as a training aid 
as the need arose, it was reactivated from Africa about two-and-one- 
half years post-launch and all basic systems were normal. It had been 
dormant (turned off) for about 18 months at that time. 

f. lANDSAT-I 

Redundant units In two equipment groups were 
switched Into service after long periods of dormancy on LANDSAT-I. A 
redundant S-band receiver/transmitter was turned on after just short of 
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two years of dormancy. Also, a redundant Rate Measurtn 9 Package was 
switched into service after approximately 26 months of dormancy. The 
data bank contains no reported anomalies on these previously doiwant 
equipment groups. 


g. $MS/60E6 

Ihe SMS/GOES program consists of long-life, geo- 
stationary weather satellites. All subsystems were designed for a satel- 
lite life time ot five years and contain considerable redundancy. Many 
of these redundant elements on SM^-1, SMS-2, and GOES-1 have experienced 
periods of donnancy followed by non\wl operation. GOES-2 (launched June 
16. 1977) has not yet accumulated any significant dornuincy periods. 

On SMS-1, a UHF receiver and an S-band r'eceiver operated noimwlly 
after dormancy periods of approximately seven months each. On SMS-2, a VHP 
transmitter operated normally after tour ninths of doriiwncy, and an 
S-band receiver after six months. On GOES-1, a UHF receiver was donnant 
tor seven months, then operated normally. Also, a VHF transmitter was 
dormant for two periods of three months each, and operated without fault 
after both periods. 

?. Components and Piece Parts 

The primary data regarding donnancy or standby operation 
for components and piece parts is suninarixed in Exhibit 22. The exhibit 
shows the number of items in the sample of this update, the pre-update 
sample, and the combined san^le together with the number of orbital hours 
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the Items In each category were known to have survived in space in a non- 
operating condition. Only one item (a battery) is even suspected of failing 
during dormancy or standby and even for this battery there seems to be no 
causal relationship. An explicit calculation of failure rates is therefore 
inappropriate. The sheer number of hours accumulated against some items, 
however, indicates that a rather low rate would be appropriate. 

Exhibit 23 tabulates the upper 90 percent confidence limit on the 
dormant failure rate for selected components and piece parts using the 
combined data base. For comparative purposes, the upper 90 percent con- 
fident limit on the overall on-orbit failure rate is also presented. 

The generally higher dormant failure rate limit simply reflects the re- 
duced amount of data available, but for many components and piece parts 
the failure rate limits are quite comparable. For three hardware elements 
the dormant failure rate limit is actually less than the overall on-orbit 
limit. These three elements and their failure rate statistics are: 


Failure Rate (Failures/Million Hours) 


Hardware Element 

Dormancy 


On-Orbit 


A- 


X 

Xg 

Magnetic Tape Units 

4.5 

14.0 

24.0 

37.0 

Transmitters, Wideband 

6.3 

1.4 

5.0 

14.0 

Vidicon Cameras 

8.2 

2.2 

5.1 

10.0 


For vidicon cameras and wideband transmitters, the upper failure rate 
confidence limits are about equal which only Indicates that dormancy Is 
probably no worse than general on-orbit experience. The Magnetic Tape 
Units, however, indicate a clear cut failure rate reduction from dormant 
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EXHIBIT 23 - COMPARISON OF UPPER 90 PERCENT CONFIDENCE LIMITS FOR DORMANT 
AND GENERAL ON-ORBIT FAILURE RATES 


Hardware Elemen;: 


Upper 90 Percent Confidence Limit on 
Failure Rate (Fallures/Minion Hours) 


Oormanci 


On-Orbi t 


Amplifiers (1) 

7.2 

0.58 

Battery Packs 

16.0 

2.3 

Comnand Decoders 

9.2 

1.25 

Command Distribution Units 

16.0 

5.6 

Computers 

3800.0 

n.o 

OC/DC Converters 

5.3 

2.2 

Gyros 

10.0 

5.2 

Heaters 

2.4 

1.1 

Magnetic Tape Units 

4.5 

37.0 

Oscillators 

5.1 

1.7 

Receivers 

7.1 

1.8 

Regulators. Voltage 

3.6 

1.6 

Transmitters, Wideband 

6.3 

14.0 

Transmitters, Other (2) 

1.3 

0.043 

Transponders 

11.0 

8.0 

Vidicon Cameras 

8.2 

10.0 


Piece- Parts 

Battery Cells 
Capacitors 
Diodes 
Fuses 

Integrated Circuits 

Relays 

Switches 

Thermistors 

Transistors 

Tubes. General Purpose 


0.76 

0.010 

0.0059 

1.3 
0.035 
0.25 

1.4 

1.2 

0.0093 

1.5 


0.097 

0.0016 

0.0019 

0.19 

0.0053 

0.029 

0.98 

0.24 

0.0033 

1.4 


Notes: (1) These amplifiers do not Include power ampllfle*^. 

(2) Thcie transmitters are other than: beacon transmitters. 
DoppVer transmitters, FM transmitters, S-band transmitters, 
special purpose transmitters, tracking transmitters, wide- 
band transmitters, or video transmitters. 
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operations; a reduction factor of nearly 10 to 1 is indicated. It is 

therefore reasonably clear, and made clear by demonstration from actual 

field data, that dormant failure rates are lower for some components than 

1 

general in>orb1t rates and hence lower than operating failure rates. 

It is reasonable to conjecture that additional data would extend this 

conclusion to other components as well. 

In addition to the above data, two additional reports related to 

dormancy and reliability came to light in the course of the data bank 

2 

studies. The first of these uses a two-year set of data from the space- 
craft known as ESSA 2 through ESSA 9 with particular emphasis being given 
to the vidicon cameras and tape recorders on the AVCS satellites (ESSA 
3, 5, 7, and 9). Both dormant and operating data were found on these 
components and were analyzed. The conclusions from this analysis are 
as follows: 

"For the vidicon cameras and tape recorders of the TOS satellites 
designated ESSA 3, S, 7, and 9, correlation analysis was done using the 
data available on these subsystems in a', attempt to establish a relation- 
ship between pattern of use and subsystem performance and between pat- 
tern of dormancy and subsystem performance.... No distinct differences 
in correlation were found between "good" subsystems and "bad" ones. 

*Thls Is true since the in-orbit rates are based on a combination of 
powered and unpowered hours in unknown ratios. 

^Stanford Research Institute, A Study of Dormant-Mode Reliability for 
the TOS Satellite Systems, Robert S. Ratner and C. Bruce Clark, January 
lOT,~TKTnan^ep6rt oB "Contract NAS 12-33 (Item 10) SRI Project 5580). 
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"There are four possible explanations for this lack of a positive 
result. The first is that the data available are not complete or extensive 
enowqh for a statistical analysis. The second is that there is no rela- 
tionship between performance and operation. Thirdly, the correlations 
done may not be sufficiently sophisticated to reveal the relationship 
present. Fourthly, the components we are dealing with appear not to be 
samples of a larger population in a statistical sense--that is, each 
component is sufficiently different so as to obscure any relationships 
between them." 

The second report is from the Aerospace Corporation^ and concludes 
on the basis of a theoretical analysis that dormant and operating failure 
rates for electronic parts tend to equality as part quality and application 
conditions improve. The following tabulation of Q-factors is offered 
where Q-factor is the ratio of dormant failure rate to operating failure 
rate. 


Q-FACTORS AS A FUNCTION OF PART QUALITY 


Quality Level 

Q-Factor 

Quality Requirements 

Mil-Std 

0.1 

Military Specification quality control with 
no additional screening. 

Mil-Std-Aug 

0.5 

Military Specification quality control aug- 
mented by special requirements and some 
screening. 

Hi-Rel 

0.8 

Rigorous Specifications, stringent manufac- 
turing controls, excessive screening. 


Hhe Aerospace Corporation, Report No. TOR-01 72(21 33), Failure Rates 
of Non-Homogeneous Parts Populations , A.C. Reed, 15 SeptenRier 1971. 
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B- ON/OFF CYCLING 

Related study efforts bearing on this subject area which 
utilize the space data bank are reported In References 4. 5« and 6. 
References 4 and 5 are sequential efforts devoted to the 5»*11'b111ty 
effects of ground storage, space dormancy, standby operation and on/rff 
cycling on satellite electronics. Reference 6 discusses the reliability 
of spaceborne switching devices. As outlined In the prevlouf reports 
and confirmed In this study effort, defining the suoject matter In 
clear and unambiguous terms Is the most difficult part of the problem. 

This difficulty Is a function of the dynamic behavior of nearly all 
orbiting spacecraft and particularly the more recent and complex satellites. 
Each major subsystem may be characterized by a number of operational modes, 
many components are normally subject to cyclical operation (for example, 
the record and playback cycle of tape recorders, battery charge and dis 
charge cycles, etc.) and configuration changes via the ground/spacecraft 
link are common on nearly every pass. To compound the problem there 
are rarely sufficient data to quantify any of the parameters associated 
with the above operation (time spent In playback mode or record modes, 
number of playbacks, operational hours per mode, etc.) 

The approach taken to surmount this difficulty Is that used in 
all four study efforts. That Is. reliance 1$ placed on "known" values, 
with engineering assumptions being kept to an absolute minimum. Hhcn 
available program documentation provides clear and reasonably straight- 

forward data regarding the cycling of spacecraft components. It Is re- 

* 

ported; otherwise. It Is not. 
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Exhibits 24 and 25 summarize pertinent data with respect to on/ 
off cycling and standby operation. Only data points which were sufficiently 
well documented to provide a complete line of information in these exhibits 
were included. By the same token, the data presented In these exhibits 
are all that is available from the data bank which carries all the data 
elements identified in the column headings. Two exhibits were constructed 
to separate those spacecraft components built with the later integrated 
circuit technology from the earlier spacecraft constructed primarily from 
discrete piece«parts. There are 142 entries representing the earlier 
technology and 49 representing integrated circuit components. The com- 
ponent type is quite variable ranging from a 20-piece-part power con- 
verter to an entire spacecraft consisting of some 20,000 electronic piece- 
parts. The names of the components are purposely kept somewhat general; 
however, their use in conjunction with the column indicating the number of 
discrete parts (or integrated circuitsl contained in the component should 
give a reasonable idea of its general characteristics. 

The survival hours represent the time that the component under 
consideration was known to be operable. Power-on time is the number of 
hours that full, nominal power was applied to the component. Survival 
hours minus power-on hours gives the time that the component was dormant 
or on inactive standby.^ The number of cycles is essentially the nwrt)er 
of turn-ons, i.e., switching from inartive standby to full, nominal power. 
It is not too unreasonable to assume that the on periods in each cycle are 
approximately equal. 

^The terms "dormant" and "Inactive standby" are considered to be synony- 
mous in this renort. 
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The final column lists the number of anomalies. All recorded 
instances of anomalistic behavior recorded against the components of 
interest are listed here. Components failing catastrophically are as 
follows: discrete part components which failed catastrophically at the 
indicated survival hours are those represented by the index numbers: 6, 

35, 36. 109, 111, 113, 116, 117, 118, 119, 120, and 133 (Exhibit 24); 
catastrophically falling integrated circuit components are listed as in- 
dex numbers 19, 32, 33, and 47 in Exhibit 25. 

The most notable feature of these data, taken as a whole, is 
the general lack of anomalistic behavior associated with the cycled compon- 
ents. Not evident from the exhibits is the fact that none of these 
anomalies can be attributed, unambiguously, to the cycling itself or to 
the dormant period of the component's operational profile. 

Comparing the data of Exhibits 24 and 25 to the survival data 
including all kinds of operation, there is no striking or statistically sig- 
nificant difference. There are, for example, 51 transmitters represented 
in Exhibits 24 and 25 with a total of 455,779 survival hours, no cata- 
strophic failures,^ and 27,517 on/off cycles. In terms of survival hours 
this represents a 90 percent confidence interval on the failure rate of 

0 to 5.1 x lO”® failures per hour compared to the interval of 1.5 to 

-6 

3.9 X 10 failures per hour that may be found from the data of Section 
III for all transmitters. These results are not unexpected given that 
the two populations are essentially equal in terms of failure rate. To 

Although there are 10 anomalies recorded against six integrated circuit 
transmitters, none of these resulted in the termination of transmitter 
operations. 
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deduce from this example that cycled and uncycled components* which are 
otherwise similar, have the same failure rates Is not warranted, however, 
on two counts. First, It Is not unlikely that all the transmitters In- 
cluded In the Section III analysis were cycled to some extent, those 
represented here being simply the transmitters for which quantitative 
cycled data are available. The second problem Is the sparsity of failure 
data which tends to make all failure rate comparisons somewhat nebulous. 

It Is rather clear, however, that cycled components In general do not 
have "order of magnitude" higher failure rates than their noncycled 
counterparts. 

There may well be compensating tendencies In the cyclic mode 
of operation In that turning a component on and off may be detrimental 
to reliability whereas periods of no or reduced stress (1e., "dormancy") 
may be beneficial. In the analysis of Reference 5, the detrimental effect 
of on/off switching was found for the various scientific experiment pack- 
ages of an observatory class satellite; the beneficial effects of jormancy 
were not found. These relationships are repeated here In Exhibit 26. The 
data on spacecraft components shown In Exhibits 24 and 25 were analyzed 
In a manner similar to that which produced the results of Exhibit 31. 

First, however, the data of Exhibit 24 was further subdivided to 
separate ou those components which represent entire spacecraft. Three 
sets of data then result, two from Exhibit 24 and one from Exhibit 25. 

The first set consists 7f cycling data on components primarily constructed 
of discrete piece parts (Exhibit 24). The second set (Exhibit 25) Is simi- 
lar but the components are constructed primarily of Integrated circuits. 

The last data set (Exhibit 24) Is that representing cycling data on entire 
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EXHIBIT 26- FAILURE RATE VERSUS CYCLING RATE AND DUTY 

CYCLE FOR SPACEBORNE SCIENTIFIC EXPERIMENTS 
(FROM REFERENCE 2) 









spacecraft all of which, coincidentally, are constructed primarily of 
discrete piece parts. There are 130 data points in the data set for 
discrete part components, 49 for integrated circuit components and 12 
for entire spacecraft. 

Dividing power-on time by survival time and multiplying by 100 
gives the duty cycle for each component. Cycling rate is the number 
of cycles divided by survival time. The distribution of the number of 
anomalies, failures, survival hours, and numbers of components, is 
given for these two variables for each of the three data sets. These 
distributions are shown in Exhibits 27, 28, and 29. Exhibit % sums 
these distributions across component types. 

An anomaly rate (or a failure rate) may be obtained for any com- 
bination of cycling rate and duty cycle given by simply dividing the num- 
ber of anomalies (failures) appearing in the appropriate cell of the upper 
matrix by the monber of survival hours appearing in the same cell of the 
lower matrix. For example, the anomaly rate for integrated circuit com- 
ponents with a cycling rate between one cycle per thousand hours and one 
cycle per hundred hours and a duty cycle between 50 and 90 percent is 
given by 9/239292 » 38 anomalies per million hours. The corresponding 
failure rate is 4.2 failures per million hours; both estimates are based 
on data from 17 components. 

Since there are generally so few anomalies associated with each 
indivichial cell it is recommended that anomaly or failure rates derived 
as in the example be used with some care. Exhibit 31 presents these 
rates for the marginal and overall totals. 
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EXHIBIT 29- DISTRIBUTION OF ANOMALIES, FAILURES, COMPONENT SURVIVAL HOURS AND 
NUMBERS OF COMPONENTS BY DUTY CYCLE AND CYCLING liATE FOR ENTIRE 
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KXmWT 31 - ANOMALY RATES («) AND FAILURE RATES (« FOR 
VARIOUS COMPONENT TYPES AND DUTY CYCLES 
ANt> FOR VARIOUS COMPONENT TYPES AND 
CYC UNO HATES 
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With respect to duty cycle no clear cut trends are evident. For 
both integrated circuit and discrete part components the maximum anomaly 
(and failure) rate occurs at the minimum duty cycle. For the discrete 
part components there Is clearly a strong correlation between low duty 
cycle and high cycling but this is not the case for integrated circuit 
components. 

As regards cycling rate the data show a general decline In anomaly 
rate with Increasing cycling rates from very low values of cycling rate 
up to about one cycle every 10 hours. No data beyond this point are 
available from entire spacecraft and no failures or anomalies were found 
against integrated circuit components at rates of cycling faster than once 
in 10 hours, for discrete part components a large increase In both 
anomaly rate and failure rate is noted in this region. Theories to ex- 
plain this phenomenon are left to the reader as an exercise. 

To determine if component size (i.e.» the number of piece parts 
a component contains) Influences the results, the tabulation ov Exhibit 
32 was constructed for discrete part components. Although the general 
pattern noted earlier carries over here (i.e., a decreasing anomaly rate 
with Increasing cycle rate until a cycle rate of 0.1 cycles per hour Is 
reached at which time the anomaly rate Increases drastically) the only 
clear conclusion that can be drawn on the basis of the data Is thrt cycling 
in excess of 0.1 cycles per hour Is worse, from the point of view of 
reliability, than cycling at a lower rate. To see this more clearly 
consider the following two-by-two array based on anomaly rate. 



^ ti 




Components with more Componetsts with 1 50 
thsm 150 Piece Parts or itwer Piece Parts 


m R-1863 

m 


EXHIBIT 32 - ANOMALY AND FAILURE RATES AS A FUNCTION OF 
COMPONENT SIZE AND CYCUNQ RATE 
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EXHIBIT 33 - ANOMALY RATE^ AS A FUNCTION OF COMPONENT SIZE AND CYCLING 
RATE 

It Is not clear on the basis of the foregoing whether cycling 
per se Is detrimental to spacecraft components, compared to steady 
state operation; It Is reasonably clear, however, that If spacecraft 
components are to be cycled It Is desirable to reduce the cycling rate. 

C. RELATIONSHIP OF PROJECT SUCCESS TO PRODUCT ASSURANCE 

Product assurance elements are defined here to include the reli- 
ability, quality assurance, and related activities conducted from design 
and development through the final checkout of the spacecraft at the 
launch site. An attempt was made In this update to collect this kind 
of information; the results are summarized In Tables 5 and 6 of the en- 
gineering analysis reports (see Appendix B). This Information Is less 
available, more uneven In quality and considerably ■ quantitative than 
the other data elements collected during the study. Much of the Informa- 
tion, for example, comes from contractor "In-house" documentation which 
Is difficult to obtain once the spacecraft contract Is closed. Also, 
many of the spacecraft In this update have evolved through long-term, 



Anomaly rate Is given In anomalies per million hours. 


on-going programs (the NOAA spacecraft, for Instance, evolved from the 
earlier TIROS and ITOS spacecraft). In these cases, the traditional 
R & QA activities tend to be minimal, with evaluations of actual operating 
performance serving Instead as a basis for corrective actions. 

Of the 42 spacecraft added to the data bank on this update, vary- 
ing amounts of Tables 5 and 6 data were available for 30 of them. In 
some cases the data can only be described as skimpy; in other cases the 
tables contain a fair amount of detail In some areas and little or no 
detail in others. In a few cases, data coverage is detailed for all 
pertinent areas. This is the same situation that was encountered dur- 
ing the first data bank study. (On the two subsequent data bank studies, 

R & QA information was not sought since the objectibves of those two 
studies did not require it.) 

The previous attempt (during the first data bank study) to relate 
product assurance to project success was relatively unsuccessful. All 
spacecraft programs were rated as to their "success" by classifying them 
as "marginal," "successful," or "outstanding success." Then ratings of 
a similar type for the same programs were developed for the following 
product assurance elements: 

• Development Testing 

• Parts Selection 

• Quality Control Provisions 

• Off-the-'ihelf Versus New Design 

• Prelaurxh Activities 
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f Spacecraft Complexity 

• State-of-the-Art 

Attempts were- then made to find some correlation between the program suc- 
cess ratings and the ratings for the various product assurance elements. 
Correlating techniques such as regression analysis were applied, with the 
result that no well defined, quantitative trends could be Identified. At 
the time, this lack of measurable correlation was attributed to lack of 
good data. 

It was felt that this situation might have been remedied In this 
study, but unfortunately It was not. In fact, the approach developed ear- 
lier was determined to be Inapplicable to this update for two reasons: 

(1) the programs represented In the update were generally quite successful, 
and (2) for all programs where the data are available, at least a serious 
R & QA program existed. The resulting situation Is that there are not 
sufficient "gradations" In the update data to allow for a meaningful 
scale of comparisons. 

Mith respect to the data on R & QA programs In this update, 
three basic approaches were noted: (1) on low-budget programs, use of 
previously space qualified hardware and designs was emphasized; (2) on 
the programs with fewer budgetary restraints and, concommitantly, more 
complex spacecraft, more testing was conducted and more stringent R & QA 
controls were Implemented; and (3) on long-term programs where spacecraft 
evolved from earlier designs, the emphasis was on evaluating actual or- 
bital performance to provide a basis for corrective actions. The suc- 
cess of the spacecraft represented In this update would Indicate that 
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each of these three R A QA approaches was adequate for its associated 
situation. 

P- EX PERIENCE BULLETINS 

This subsection sumnarlzes the six Experience Bulletins prepared 
as part of the special studies on this effort. These bulletins are based 
on engineering analyses using the data bank as a resource, and highlight 
areas that warrant increased consideration on new projects. The six 
Experience Bulletins are provided in Appendix D. Their major findings 
are summarized belov*. 

Exp erience Bulletin #1 ; Persistent On-Orbit Problem Areas 

Analysis of the update data for spacecraft launched in the 1970s 

indicates that anomaly types that have been persistent in the 

past are still occurring. Eight categories of these persistent 

anomaly types encompass approximately one-half of all anomalies. 

Experience Bulletin #2 : Some On-Orbit Reliability Aspects of 

Inteorated Circuits 

The data bank contains information on over 100,000 integrated cir- 

Q 

cults which accumulated 2.0 x 10 survival hours on-orbit. These 
data indicate that the orbital reliability of an integrated cir- 
cuit is quite similar to that of a transistor. Also, there is 
some evidence that integrated circuits have reduced the number 
of problems associated with circuit design. 

Experience Bulletin #3 : Areas With a History of Few On-Orbit 

ProtTems 

Evaluation of the data bank indicates that most spacecraft hard- 
ware arp'is have incurred a number of anomalies. Six areas were 
identified, however, that have essentially trouble-free histories. 


Experience Bulletin #4: On-Orbit Interference (RFI) From 

Exterhai Sources 

The data bank contains at least 20 cases of problems in space- 
craft RF equipment due to interference from a source external 
to the affected spacecraft. In some cases the external source 
was another spacecraft; in some cases the source was unknown. 
Analysis indicates that this type of incident is increasing. 

Experience Bulletin #5 : Some On-Orbit Reliabili ty Aspec ts o f 

On- Board Progranwiabl e , wneraT Purpose 
Computers 

This update Is the first data bank effort in which data from on- 
board, programmable, general purpose computers began to become 
available. This limited amount of data indicates that the space 
environment has not introduced any unusual types of anomalies. 

The capability for reprogramming in-flight is recommended. 

Ex peri en ce Bu lletin #6 : Speci fic, Orbi tal Anomalies Po sing 

Potential Reliability ProbTems 

Three specific types of anomalies were noted on this update which 
had not been seen to any significant extent, if at all, on previous 
data bank studies. These include array temperature sensor fail- 
ures, leaks through thin windows, and thruster catalyst bed 
susceptibility to RFI, These anomaly types may either denote 
the beginning of a trend, or signify some basic, underlying 
problem. 
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Appendix A 

ANOMALOUS INCIDENTS LISTINGS 

This appendix Is divided Into four sect1ons--one for each 
previous data collection ef^irt (References I, 7, and 9) and one for 
this study. The sections and their respective data sets are as follows: 

(I) 1967 Study (Reference 1) 

(II) 1971 Update (Reference 7) 

(III) 1972 Update (Reference 9) 

(IV) 1978 Update (Current Study) 

Each section contains two parts that Include part (a), the 
basic data tabulations; and part (b)» classification codes. There- 
fore, for example. Appendix A-IIIb contains the classification codes 
for the third data set. The contents of these parts are discussed 
below. 

PART (a): BASIC DATA TABULATIONS 

This part contains. In tabular form, the basic data referred to 
In Sections II. Ill, and IV of this report. The tables presented here 
win provide the reader with a means to understand the couvlUtion pro- 
cedures used In this study and facilitate any further classification or 
analysis of particular Interest to the Individual. 

The first step In the data reduction procedure (using the Engi- 
neering Analysis Reports described In Appendix B) was to produce a list- 
ing that contained the following data elements associated with each space 
craft of the sample: (1) unsuccessful launch, primarily due to the launch 
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vehicle; {?.} successful launch with reported anomalies; and (3) success- 
ful launch with no reported anomalies. 

The tabulation of this section lists first the unsuccessful 
launches. Reported anomalies are listed next, ordered by time of occur- 
rence and containing these data elements: 

• Time-to-occurrence of anomaly in hours. A time e is 
associated with the launch interval, prior to injection 
into orbit. The symbol ' denotes either unknown time 
or intermittent occurrence. 

• Three short phrases indicating the description of the ob 
served anomaly, its suspected or known cause, and the 
effect on the mission objective(s). 

• Corrective actions, both in-orbit or for subsequent 
launches, if known. 

• Brief remarks, if needed to place the anomalous incident 
in context. 

The last group, successful launches with no reported anomalies, 
ends the basic data tabulation. Data elements for this group are (1) 
whether or not the spacecraft is still operational and (2) total space- 
craft time included in this study. 

The sequential coding, the index listed in column 1, provides a 
means of cross reference to the table presented in part (b) of the re- 
spective section. 
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PARJ. cpojs 

This part is a listing of classification codes for each of the 
anomalies of the basic data tabulations in Part (a) of the section. For 
convenience, the Identification of the anomaly characteristics discussed 
in Section II of the text and the alpha-numeric codes employed are re- 
peated at the end of this Introduction. 



NOTE: The following matrix shows the index numbers of anomalies that 
were updated in subsequent reports. For example, the ano«naly 
which corresponds to index number 22 in the 1971 report 
(RefemKe 7) is updated as index number 3 in the 1972 rei>ort 
(Reference 9). 


1971 Update 

W2 

Cujrent^S 

# 22 

# 3 


# 130 

# 27 



# 9 

# 16 


« la 

1 70 


# 23 

1 83 


# 33 

1 121 


# 36 

# 124 


» 37 

1 126 


# 48 

# 170 


1 108 

# 408 


# 127 

I 447 
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ANOMALOUS INCIDENT CLASSIFICATION CODES 


!• Mission Subset 

U. Unsuccessful Launch 

S. Spacecraft with No 
Anomalies Reported 

Spacecraft with 
Anomalies Reported 

II. Mission Term 

L. Long Term 
S. Short Term 

III. Mission Phase 

L. Launch and Acquisition 

0. Orbital (Steady-State) 

Q. Unknown 

IV. Mission Effect 

1. Negligible 

2. Non-Negligible but Small 

3. 1/3 to 2/3 Mission Loss 

4. 2/3 to Nearly Total 
Mission Loss 

5. Essentially Total 
Mission Loss 

U. Unknown 

V. Spacecraft Subsystem 

a. Timing, Control and 
Command 

b. Telemetry and Data 
Handling 


c. Power Supply 

d. Attitude Control and 
Stabilization 

dT Propulsion 

e. Environmental Control 

f. Structure 

g. Payload (Experimental 
and Scientific) 

h. Unknown 

VI. A. Incident Type 
E. Electrical 

M. Mechanical 
0. Other 

U. Unknown 

VI. B. Incident Type 

C. Catastrophic Part 
Failure 

0. Other Part-Related 
Incident 

N. Non- Part-Related 
Incident 

U. Unknown 

VII. Incident Cause 

A. Assignable 

N. Non-Assignable 

U. Unknown 
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Appendix B 

ENGINEERING ANALYSIS REPORT 


A. INTRODUCTION 

This appendix describes in detail the data recorded on the working 
papers generated for this study. Using the available documentation for 
each spacecraft in the data sample, these working papers, called engineer- 
ing analysis reports, were produced for each launch in the data bank. Not 
all the data described below were available for each spacecraft. 


B. Engineering Analysis Report 
1 . General Data Elements 

Each engineering analysis report begins with a short gen- 
eral description of the spacecraft and the main objectives of its parent 
program. This introduction also includes a short narrative of the flight 
experience of the spacecraft and the time interval covered by the subse- 
quent pages of the report. 

Table I lists general information needed for the analysis: (1) 

name of the mission; (2) the launch vehicle, with a brief description of 
an abortive launch if one occurred; (3) launch date; (4) orbit parameters 
including information relative to incorrect orbits due to launch vehicle 
malfunctions; (5) name of the sponsoring agency and prime contractor; 

(6) an overall evaluation of the in-flight performance; and (7) program 


objectives as given by the program office. 


nO 


✓ 




5 ^ 
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TABLE I - GENERAL INFORMATION 

Mr: ION: 

LAUNCH VEHICLE: 

Describe abortive launch if occurred. 
ORBIT PARAMETERS: 

AGENCY AND PRIME CONTRACTOR: 

PERFORMANCE (Were the Following Objectives Met?) 


PROGRAM OBJECTIVES: 



Reliabi lity D ata Elements 

Data elements needed to perform the pertinent reliability 
analysis were entered in three tables of the engineering analysis report. 
Table II contains the hardware breakdown to two levels of indenture: (1) 
subsystems, i.e., power subsystem, timing, control, and command subsystem, 
etc.; and (2J equipment group and/or component, i.e., solar array, bat- 
teries, command receivers, beacon transmitters, etc. Tne list of subsys- 
tem names varies by the complexity of the spacecraft under analysis; the 
precise definition of the subsystems, that is, those functions assigned 
to a particular subsystem for purposes o^ this report, are found in sub- 
section II.D.2. The equipment group or component list also is dependent 
on the particular spacecraft under analysis. It is important to note 
that the intention here is to define the second-level indenture so that 
the number of powered and unpowered hours (columns 2 and 3 of Table II) 
are applicable to all piece-parts within the given grouping. That is, the 
level of group or component definition is such that all constituent parts 
operate on the same duty cycle. 

Redundancy among equipment groups and/or components was taken into 
consideration when entries to columns 2 and 3 were made. If the documen- 
tation was such that each unit in a redundant configuration was known to 
have survived, say, 1,000 hours, then 2 units are entered for 2,000 hours. 
However, if all that is known is that the redundant configuration survived, 
then the entry is 1 unit for 1,000 hours. 

The purpose of columns 2 and 3 on Table II, powered and unpowered 
hours, is to obtain data from which "standby" reliability might be esti- 
mated. Again, it is emphasized that only known hours for the two 
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classifications are recorded. Assumptions concerning duty cycles were 
limited. 

Column 3 on Table II, number of cycles, was used for those hard- 
ware groups for which the relevant variable is cycles or actuations. 

Other columns in the exhibit are self-explanatory. The reference 
column was included so that the source of the data underlying the results 
could be easily identified. It is noted that this "traceability" is pre- 
served on all working papers thorughout the data analysis; for example, 
all anomalous behavior classifications are coded so that any question 
concerning data classification or assumptions can be answered by search- 
ing back to the original entry in the engineering analysis report. 

Table III shows another format in the engineering analysis report 
used to record the number of piece-part types for each higher level group- 
ing of hardware shown in Table II. The column labeled la, for example, 
is the first equipment group or component in the first subsystem listed 
on Table II. A "total" column was p 'ovided for those spacecraft where 
a parts breakdown by equipment group or subsystem was not available. 

The I’st of piece-parts varies not only by spacecraft but also 
by the available documentation for the spacecraft. By far the most dif- 
ficult data element to obtain was the spacecraft parts list; also the 
level of detail given on parts lists that were obtained was very sparse. 
With some exceptions, subgroupings within a part type were not avail- 
able, For exan»ple, the total number of resistors used in the space- 
craft was generally known, out the types of resistors was not specified. 
The resulting analysis is necessarily limited to the generic part 
nomenclature. 
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TABLE III - PARTS BREAKDOWN 


S 


Total 
Number 
of Parts 


Number of Parts Per Subsystem and 


Equipment Group/Component 
(Coded as on Table I) 


Battery cells la lb Ic ... 2a 2b 2c ... 3a 3b 3c ... 

Bearings 

Capacitors 

Diodes, 

Semiconductors 
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Table IV shows the format for recording spacecraft anomalous be- 
havior. The description includes a narrative giving the consequences of 
the anomalous behavior: for example, (1) effect on the mission (cata- 

strophic, negligible, modified by actions performed by ground stations, 
etc.), (2) effect on other hardware groupings (Induced additional anoma- 
lous behavior, loss of equipment through deliberate shutdown by ground 
stations, etc.), and (3) implications on subsequent launches (corrective 
actions on hardware, changes in orbit parameters, etc.). Provision wa? 
made in the final column for any other pertinent comment relative to the 
overall study; of particular importance are any comments relative to as- 
signable causes for the anomaly. Finally, the anomalous behavior event 
is referenced on each of the three tables. (This cross-refer«nc1ng aids 
the anomalous behavior classifications tabulated in text Sections II, III, 
and IV.) 

In this connection, it is emphasized that a particular anomalous 
behavior event is not necessarily attributable to a particular piece-part. 
In fact, only a few such events can be attributed to a particular part- 
type as suggested in Table III. In most cases, however, anomalous be- 
havior events can be assigned to hardware at the subsystem level , and in 
many instances, at the equipment group and/or component level (Table II). 

3. Development and Prelaunch Elements 

The development and prelaur.ch elements were defined in 
the earlier study by means of five potential factors present in these 
two intervals of a spacecraft lifetime. These five factors are listed 
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TABLE IV . ANOMALOUS BEHAVIOR DESCRIPTION 


Time to 

- .. Failure 

Identification (hours) Consequences 
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in Table V together with a bnef description of the specific information 
required. 

Prelaunch activity is explained on Table VI. Basical 1>, this table 
discusses tests and checkouts conducted prior to launch. 

4. Su mmary 

The four tables just described and the general data ele- 
ments discussed above comprise the data format used in this study in pre- 
paration for the data analysis. The first step in the analysis procedure 
was to generate the anomaly listing; this listing becomes the data basis 
for Che analysis of Sections P, III, and IV of the text. 
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TABLE V - DEVELOPMENT ACTIVITY 

A. TESTING 

Narrative indicating itens subjected to tests, duration of tests, 
testing of new items, etc. 

B. PARTS SELECTION 

Description of types of specifications, part screening, parameter 
drift screening, etc. 

C. QUALITY ASSURANCE PROVISIONS 

Description of quality assurance procedures imposed on or by the 
contractor, i.e., NPC 200-2 or 200-3; special provisions, etc. 

D. OFF-THE-SHELF VERSUS NEW DESIGN 

Estimation of the percentage of equipment groups in the spacecraft 

that can be lassified as off-the-shelf versus new design. Note 
th-.t at d part level almost all can be considered "off the shelf," 
and at a subsystem level almost all can be considered "new design." 
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TARLF VI - PRELAUNCH ACTIVITY 
TEST A ND CHECKOUT 

Description of the extent of test and checkout at the launch site; 
description of types of tests, record of anomalies durinq this 
period; description of mating problems if any, length of time 
interval, etc. 
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Appendix C 
DATA BANK COVERAGE 






Appendix C 
DATA BANK COVERAGE 




INTRODUCTION 

The chart in this appendix lists the spacecraft in the data bank. 
The spacecraft are arranged in numerical order by EAR numbers. 

For each spacecraft, the chart shows the launch date, spacecraft 
status, and the degree of completeness of the tables in tne EAR*. For 
some of the spacecraft, not all the information was available and for 
unsuccessful launches, some of the tables were not applicable, i.e.. 

Table II: Operating Time; Table III: Parts Breakdown; and Table IV: 

Anomalous Behavior Description. 
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Experience Bulletin No. 1 
PERSISTENT ON-ORBIT PROBLEM AREAS 


August 1978 


Prepared under Contract No. NASW-3041, 

"Study of Reliability Data From In-Flight Spacecraft" 


for 

National Aeronautics & Space Administration 
NASA Headquarters, Washington, D.C. 







A Note on the Data Base for this Bulletin 


The Space Data Bank from which the results 
in this bulletin were derived is presented 
in PRC R-1863, On-Orbit Spacecraft Reliabil- 
ity, September 1978. For purposes of back- 
ground to this analysis, it need only be 
pointed out that the data bank contains 
orbital performance data spanning spacecraft 
from Vanguard to HEAO, a period of nearly 
20 years. Four primary data collection 
efforts have been made. This experience 
bulletin has been written in conjunction 
with the most recent effort. The first 
three collections analyzed 1399 anomalies 
from 310 spacecraft launched between 1958 
and 1972. The most recent collection 
added information on 708 anomalies from 
45 spacecraft launched in the seventies. 
These data are referred to herein as 
“this update." 




Experience Bulletin *1 
PERSISTENT ON-ORBIT PROBLEM AREAS 


Analysis of on-orbit data for spacecraft launched 
in the 1970s indicates that anomaly types that have been 
persistent In the pvi’it are still occurring. The analysis 
further Indicates that eight categories of these anomaly 
types encompass approximately one half of all anomalies. 


In an earlier analysis of the data bank. It was found that over 
80 percent ot all anomalies fell into 30 categories of leading problem 
areas.' It was also noted that these categories represented "persistent" 
problcmis in that the anomalies occurring on the moi'e recently launched 
spacecraft wore of the same types as the anomalies on earlier spacecraft, 
bince a significant amount of new data were collected on this data bank 
update. It was deemed desirable to re-examine these persistency trends. 

The findings of this re-examination, as described in moi'e de- 
tail below, indicate that the types of problems denionst rating this per- 
sistence in the past are still occurring. In other words, even though 
state-of-the-art advances have occurred, they have not resulted to any 
noticeable extent In "new" or different types of anomalies. Nor have 
they resulted in significant elimination of "old" types of anomalies. 

It was also found that the top five persistent problem categories, i.e.. 
those accounting for the five highest anomaly counts, have not signifi- 
cantly shifted to lower rankings. In seven other categories significant 
shifts--both up and down--were noted. 

^Bloomguist, C.E., and Winifred C. Graham, Ma IjL^.I s j>jf. 

PRC R-1833, PRC Systems Sciences Compan^ , MarcTi l97b". 
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11. analysis 

Iho .10 loading problem areas that the d.».ta bank anomalies have 
boon Coutui to essentially "group theoisolves into" aix' shown In Lxhibit 1. 
Iho atHwahes that do not tali into one of these categories have always 
been found to be widely scattered. As can be seen from Exhibit 1, 16 of 
Ibose categories involve specific types of hardvtai'e items, fleven cate- 
gories invol anomalies that are difficult to tie to a specific piece 
of harvlware, but do relate directly to identifiable functions. The re- 
nviining categories consist of three particularly caimiori and widespread 
types of ammialies. 

The rank order of these categories, in terns of the number of 
anomalies each catiHjory contains, is shown in Lxhibit The left col- 
umn in lxhibit indicates the rank order prior to this update, the mid- 
dle column indicates the rank order for this update, and the right column 
indicates the rank order for all data in the data bank. 

Previous to this update, the five top ranking categories were 
scientific instrument packages, tape recorders, camera equipment, batter- 
ies and IMl'RIl. Ihese remain top ranking categories for this update, 
except that RPl/LMl has shifted fnwi fifth to second place thus shifting 
ta}>e recorders from second to third pl.ice, and camera equipment from 
third to fourth place. A significant shift involves chemical propulsion^ 
which jumped friim fifteenth to fifth place, thus displacing batteries to 
sixth place. 

1 

Hvdixizine systems and the like, as opposed to such hardwa»*e as solid 
propellant apogee engines. 


EXHIBIT 1 - LEADING PROBLEM AREAS 
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Other significant shifts include star trackers shifting from four- 
teenth to rank with batteries for sixth place, and wideband transmitters 

shifting from fourteenth to seventh place. Also, deployable structures 
shifted from eighteenth to eighth place, and non-degradation type solar 
array anomalies shifted from twenty-second to tenth place. Two shifts 
downward that appear to be significant are the shift from sixth to 
fourteenth for command and control logic, and the shift from sixteenth 
to twenty-fifth for command RF problems other than lock-on. 

The accumulated data bank Information regarding anomaly types 
provides immediately accessible data on rank order, and shifts in rank 
order. The reasons behind these ranks and shifts, however, are not usually 
discernable without a considerable amount of further research. As an ex- 
ample, it can be postulated that shifts in equipment mix contribute to 
shifts in rank order. 

For instance, more wideband equipment was carried on spacecraft 
in this update than in the pre-update. However, only wideband transmit- 
ters shifted upward significantly; wideband receivers and transponders did 
not exhibit such a significant increase in numbers of anomalies. Another 
example involves the upward shifts in chemical propulsion and solar array 
anomalies other than degradation. There has been essentially no shift 
in the "equipment mix" for these types of equipment between this update 
and the pre-update sample. 

Similarly, the high rank of scientific Instrument packages can 
be attributed, in part, to the fact that, as experiments, they are mon- 
itored closely and anomalies are thus more likely to be detected and 
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reported. Also, many are built Dy universities and hence not subjected 
to the rigorous reliability and quality assurance provisions of basic 
subsystems. This does not appear to be the complete explanation, how- 
ever. Scientific instrument packages were treated as basic subsystems 
in a number of cases (the interplanetary spacecraft, for instance) and 
still exhibited a high anomaly rate. 

An area in which the data bank is unequivocally instructive con- 
cerns the persistence of the anomaly types. This can be seen from Ex- 
hibit J, which depicts the occurrence of the top-ranking categories in 
this update by year of spacecraft launch. 

These eight top ranking categories ai'e those "above the median." 
That IS. they account for approximately half the anomalies in all 30 
categories. As can be seen from Exhibit 3, these types of anomalies have 
occurred fairly steadily on spacecraft launched over the 15-year period 
from i 960 to 1975. 

IV. CONCLUSIONS 

Analysis of data obtained during this data bank update indicates 
the following: 

1. Anomaly types that have been persistent in the past are 
still occurring. 

2 . Eight categories of these anomaly types encompass approx- 
imately naif of the anomalies. Five of these have not 
shifted significantly from pre- to post- 1970 data; the 
eight are: 


EXHIBIT 3 - AMOMAiy CCCUftREMCE B/ YEAR OF LAUNCH 
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• Scientific Instrument 

• RFi/EMI 

• Tape Recorders 

• Camera Equipment 

• Propulsion i chemical) 

• Batteries 

f Star Trackers 

• Wideband Transmitters 

3. Upward shifts li.e.. from fewer to more anomalies) that 
appear significant, together with tneir rank order shift, 
incl ude: 

• Propulsion (chemical), from fifteenth to fifth 

• Star Trackers, from fourteenth to sixth 

• Wideband Iransmitters, from fourteenth to seventh 

• Deployable Structures, from eighteenth to eighth 

t Solar Array (non-degradation), from twenty-second 

to tenth 

4. Downward shifts that appear significant include: 

• Command and Control Logic, from sixth to fourteenth 

• Command RF (other than lock-on), from sixteenth 
to twenty-fifth 

NASA is currently developing a magnetic bubble type recorder at 
least partially to alleviate the persistent problems that have plagued 
mechanical tape recorders.^ The results of this analysis suggest that 

^See, for instance, "NASA Tests Mag” *tic Bubble Recorder," Aviation 
jjteejc and ^ace_ Techno July 24, : 78. 
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comparable cc Tective-action programs for some of the other leading 
problem areas would be extremely beneficial. Regardless of whether this 


is feasible, the leading problem areas certainly warrant increased atten- 


tion during spacecraft des.gn and development. 
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A Note on the Data Base for this Bulletin 

The Space Data Bank from which the results 
in this bulletin were derived is presented 
in PRC R-1863, On-Orbit Spacecraft Reliabil- 
ity, September 1978. For purposes of back- 
ground to this analysis, it need only be 
pointed out that the data bank contains 
orbital performance data spanning spacecraft 
from Vanguard to HEAO, a period of nearly 
20 years. Four primary data collection 
efforts have been made. This experience 
bulletin has been written in conjunction 
with the most recent effort. The first 
three collections analyzed 1399 anomalies 
from 310 spacecraft launched between 1958 
and 1972. The most recent collection 
added information on ^08 anomalies from 
45 spacecraft launched in the seventies. 
These data are referred to herein as 
"this update." 
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Experience Bulletin #2 
SOME ON-ORBIT RELIABILITY ASPECTS 
or IN1EGRATED CIRCUITS 


The UdU hank contains information on over 100,000 
integrated circuits which accumulated 2.0 x lo" survival 
hours on-oroit, These data indicate that the oroital reli- 
ability ot an integrated circuit is quite similar to that 
of a transistor. Also, there is some evidence that inte- 
grated circuits have reduced the nuiiher of problems associ- 
ated with circuit design. 


I . INLRlQjlCTJON 

The update under this contract marks the first of the four data 
bank studies in which the spacecraft analyjed made extensive use of in- 
tegrated circuits. It was therefore felt appropriate to examine the 
available integrated circuit data for the reliability insights it might 
provide. 

I I . analysis 

At least 3S of the 40 spacecraft in this update sample used in- 
tegrated circuits. Some spacecraft in the pre-update sample used inte- 
grated circuits, although not to the same extent as spacecraft in this 
update. 

Overall, the data bank contains orbital, operating information 
on at least lOS.dgB integrated circuits. During the orbital time periods 
of the data sample, these integrated circuits accumulated at least 
2,0 X lo'^ survival hours, There were actually many more integrated 
circuits, and hence more survival hours, because some spacecraft for 
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which parts count data were not available are known to have used integrated 
circuits extensively. 

In both this update and the pre-update sample, only five integrated 
circuits are known to have incurred random, catastrophic failures (that 
is, the type of failure consistent with the definition of the familiar 
failure rate, > ). This yields an orbital, integrated circuit failure 
rate of 0.00<J5 failures per million hours with upper and lower 90 percent 
confidence intervals of O.OObS and 0.00099, respectively. This failure rate 
does not differ significantly from the data bank orbital failure rate for 
transistors (0.0015 with 90 percent confidence intervals of 0.0033 and 
O.OOObO). 

There are at least three integrated circuit anomalies in the data 
bank that do not involve random, catastrophic failures. Two of these 
were due to gold-to-alumnium bonding setting up a reaction that caused 
corrosion. The third was due to an improper manufacturing process. The 
chips were cleaned with ammonia but then the ammonia residue w not ade- 
quately removed, thus later providing a mechanism for altering the chip's 
characteristics. The corrective actions derived to eliminate these 
anomalies on subsequent spacecraft are reported to have been successful. 

There were undoubtedly other integrated circuit anomalies In the 
data sample which were not Identified as such. For Instance, there are 
anomalous Incidents associated with equipment containing integrated cir- 
cuits, but It is difficult, if not impossible In seme cases, to determine 
If they were due to integrated circuits. 

An observation of interest on this update that may relate to In- 
tegrated circuits Involves marginal circuit operation. On previous data 
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bank studies, there have alwayr* been a number of anomalies due to inade- 
quate design margins, out-of- tolerance parameters under certain condi- 
tions, etc. While there were anomalies of these types on this update, 
fewer were noted than on previous studies. It is not clear that this can 
be attributed to integrated circuits. But, In contrast with discrete 
part circuits, the fact that they do not require circuit analysis as part 
of the design procedure would seem to eliminate some chance for error. 

III. CONCLUSIONS 

The orbital reliability aspects of an integrated circuit appear 
to closely parallel those of a transistor. Their falure rates are net 
significantly different, and while their tai lure modes, as revealed by 
the data bank, are not similar, integrated circuits do not appear to 
have introduced any "exotic” new failure modes that are beyond present 
capabilities for foreseeing and correcting. In addition, there is 
some possibility that they have reduced probl«ns due to errors in the 
design of discrete part circuits. 

It is important to note that most, if not all, the integrated 
circuits covered by the data bank were subject to rather stringent qual- 
ity assurance provisions. Thus, care should be taken in applying these 
conclusions to other classes of integrated circuits. 
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A Note on the Data Base for this Bulletin 


The Space Data Bank from which the results 
In this bulletin were derived Is presented 
In PRC R-1863. On-Orbit Spacecraft Reliabil- 
ity, September 1978. For purposes of back- 
ground to this analysis. It need only be 
pointed out that the data bank contains 
orbital performance data spanning spacecraft 
from Vanguard to HEAO, a period of nearly 
20 years. Four primary data collection 
efforts have been made. This experience 
bulletin has been written In conjunction 
with the most recent effort. The first 
three collections analyzed 1399 anomalies 
f.'om 310 spacecraft launched between 1958 
and 1972. The most recent collection 
added Information on 708 anomalies from 
45 spacecraft launched In the seventies. 
These data are referred to herein as 
"this update." 
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Experience Bulletin #J 

AREAS WITH A HISTORY OF FEW ON-ORBIT PROBLEMS 


This oxporicnco bulletin is basiHi on the t\\ot ttuit intoniuition 
cono'rniny ariMs with few, or no, problems c.in be »is useful as th<»t con- 
rerniiuj problem oreos. The oreos listed below O'e those reveolevi by the 
ditt.i bonk to hvwe such vi history of few, or no. on-orbit onomolies. Any 
insiphts avoiloble from the doto bank are also described. The criteria 
for selectlmj these are.is was that the number of anomalies charoed to each 
was fewer than one half of a percent of the total number of anonwlies 
associated with loti9-tenu, unmanned spacecraft In the data bank. 

• Basic Structure texcludinp deployable structures): 
no anomalies 

• Shrouds: two anomalies; shroud failed to eject In one 

case; corrective action (change fr^n fiber'glass to metallic 
shroud) was successful on subsequent spacecraft. Shixnid 
honeycomb panels exploded due to environmental effects 
during launch in the other case. 

• Pyrotechnics: two catastrophic failures (failure of a 

pin-puller and talluiH! of an explosive valve); a few 
degradation anomalies (combustion debris shorted an an- 
tenna, a squib short after firing created a "sneak path," 
for Instance); this performance record Is possibly due 

to the extensive redundancy utilized In pyrotechnics. 

• Magnetometers: Two catastrophic failures and several 
degradation anomalies which did not severely Impact 
performance. 
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Nutation Dampers: no catastrophic failures; thre* degra- 

dation anomalies. The first involved a leak in the damper 
that caused a significant roll error; thought tr be due 
to extensive ground testing. Th*' second involved a mech- 


anical problem with a friction stop, and was apributed 

/ 

to faulty workmanship. The third was manifesj^ed as a 
slightly longer than expected nutation transi/ent decay 
time, and was possibly due to sot«e deviation^ in liquid 
viscosity. 

• Heat Pipes: no anomalies, although it should be noted 

that only two spacecraft in the data sample carried heat 
pipes. 

It can be seen from the above that few areas meet the criteria 
described above. This occurs for two reasons. first, a stringent cri- 
teria was applied to ensure that the areas meeting the criteria did in- 
deed have an essentially trouble-free history. Second, and most impor- 
tant, evaluation of the data bank indicates that most spacecraft hard- 
ware areas have incurred a number of anomalies. This rules out describ- 
ing these areas as trouble-free, even though a significant percentage 
of these anomalies did not severely degrade the mission. 
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Experience Bulletin No. 4 
ON-ORBIT INTERFERENCE (RFI) FROM EXTERNAL SOURCES 


August 1978 
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A Note on the Data Base for this Bulletin 

The Space Data Bank from which the results 
in this bulletin were derived is presented 
in PRC R-1863, On-Orbit Spacecraft Reliabil- 
ity, September 1978. For purposes of back- 
ground to this analysis, it need only be 
pointed out that the data bank contains 
orbital performance data spanning spacecraft 
from Vanguard to HEAO, a period of nearly 
20 years. Four primary data collection 
efforts have been made. This experience 
bulletin has been written in conjunction 
with the most recent effort. The first 
three collections analyzed 1399 anomalies 
from 310 spacecraft launched between 1958 
and 1972. The most recent collection 
added information on 708 anomalies from 
45 spacecraft launched in the seventies. 
These data are referred to herein as 
"this update." 
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Experience Bulletin #4 

ON-ORBIT INTERFERENCE (RFI) FROM EXTERNAL SOURCES 

The data bank contains at least 20 cases of problems in space- 
craft RF equipment due to interference from a source external to the 
affected spacecraft. In some cases, the external source was another 
spacecraft; in some cases the source was unknown. In addition, there 
are other cases in the data bank involving RF disruptions, but it is not 
known if this was due to external interference. The cases involving 
interference from external sources reported in this update can be sum- 
marized as follows: 

Hawkeye (Explorer 52) experienced loss of data due to 
interference from OSO-5 and OSO-7; when the OSOs were 
active, Hawkeye lost about 4 percent of each orbital 
period's data. 

Hawkeye also experienced interference from OAO and GEOS 
spacecraft, but this is reported as relatively Insignificant 
Interference from an unknown source also caused "lost 
commands" on Hawkeye. 

RFI from an external source disrupted transmissions from 
both Viking Orbiters for a period of 40 minutes. 

LANDSAT-1 experienced several periods of external inter- 
ference, including one nine-day period. This resulted 
in loss of some data. 

NIfffiUS-6 reception was affected by interference from 
ATS-6 when these two spacecraft were being utilized 
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together for the Tracking and Data Relay txperiement. 

This interference was reported to be related to the ATS-6 
operating mode. 

• Although not an interference problem of the same type 
described above, radioastronomers at the Greenbank Ob- 
servatory noted interference from ATS-6. 

The cases involving interference from an external source reported 
in the data bank previous to this update can be summarized as follows: 

• Both command receivers on OGO-b were saturated for two- 
and-one-half hours by a strong RF signal of unknown origin. 

• OGO-6 experienced anomalous command reception, but no 
further inforruation is available. 

• There were numerous cases of Interference involving eight 
combinations of spacecraft on the TIROS/TOS/ESSA program. 
For instance, under certain conditions, ESSA-9 responded 
to TiROS-M commands, ESSA-4 responded to ESbA-l commands, 
ESSA-b expenenced spurious commands when ESSA-2 was in 
the vicinity, etc. Several of these cases of interference 
occurred when the spacecraft were being commanded from 
Alaska. 

• OSO-l executed many false conmands due to some unspecified 
type of interference over North Africa. This was attri- 
buted to an inadequate coding scheme, and the corrective 
action consisted of placing a special transmitter near 
the site of the interference. No further information 

is available. 
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It Is not difficult to postulate reasons for many of the interfer- 
ence problems summarized above. Possibilities range from solar flares 
and military electronic warfare exercises to Inadequate conmand coding 
schemes. The fact remains, however, that the data bank indicates exter- 
nal Interference incidents are increasing, and that they primarily en- 
compass RF problems las opposed to problems relating to coding schemes). 
This Is contrary to what would oe expected since the Increasing use of 
wideband should result in less crowded channels and more channel selection 
sensitivity. 
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Experience Bulletin No. 5 

SOME ON-ORBIT RELIABILITY ASPECTS 
OF ON-BOARD PROGRA^f^ABLE , GENERAL PURPOSE COMPUTERS 


August 1978 
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A Note on the Data Base for this Bulletin 


The Space Data Bank from which the results 
in this bulletin were derived is presented 
in PRC R-1863, Or-Orbit Spacecraft Reliabil- 
ity, September 1978. For purposes of back- 
ground to this analysis, it need only be 
pointed out that the data bank contains 
orbital performance data spanning spacecraft 
from Vanguard to HEAD, a period of nearly 
20 years. Four primary data collection 
efforts have been made. This exoerience 
bulletin has been written in conjunction 
with the most recent effort. Thr, first 
three collections analyzed 1399 anomalies 
from 310 spacecraft launched between 1958 
and 1972. The most recent collection 
added information on 708 anomalies from 
45 spacecraft launched in the seventies. 
These data are referred to herein as 
"this update." 





Experience Bulletin #5 
SOME ON-ORBIT RELIABILITY ASPECTS OF 
ON-BOARD PROGRAMMABLE, GENERAL PURPOSE COMPUTERS 


Six spacecraft in the update sample are known 
to have carried general purpose, programmable computers. 

While this is too limited a data sample to justify broad 
conclusions, the data does seem to indicate that the space 
environment has not introduced ar\y unusual types of anc>;>- 
alies. The capability for reprogramming in-flight is 
recommended. 

I, INTRODUCTION 

The time frame covered by this data bank update roughly coincides 
with the early phases of the era of readily available, "off-the-shelf" 
general purpose, prograimiable computers for space applications. Space- 
craft in the data bank sample prior to this update frequently used 
specially designed programmers, sequencers, controllers, and the like. 

Only the later manned spacecraft in the sample, however, carried identi- 
fiable, true, general purpose computers, and these units operated only 
for short durations. Hence, it was considered of interest to examine 
the performance record of the computers in the update sample. 

II. ANALYSIS 

At least six spacecraft in the update sample carried general 
purpose, progranmable computers. Some hardware on other spacecraft called 
out as programmers, controllers, etc., may also have been general purpose 
computers, but since they were not clearly identifiable as such they 
were not considered in this examination. 
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The computers on the six spacecraft, including three cases of 
dual redundancy, accumulated over 80,000 hours of survival time. Eighteen 
anomalies are charged against the computers, with the anomalies falling 
into the following categories: 

• 5 anomalies: "glitches"; caused no major problems 

• 4 anomalies: programming errors; reprogrammed in flight 

• 5 anomalies: Erroneous operation of undeterminable origin; 

caused major concern; "self healing" 

• 1 anomaly: Program updates did not load on initial 

tries; subsequently loaded properly; 
cause unknown 

f 3 anomalies: Memory probliJms; seriously degraded 

performance 

Of the five above categories, the first four are felt to be 
self-explanatory. Ihe fifth, memory problems, requires further explanation 
Of the three anomalies in this category, one involved too small a memory 
for computing fine pointing increments, with the result that only coarse 
steps were available. The second of these anomalies Involved loss of 
access, for reasons that are not clear, to a portion of memory. The third 
involved failure of four memory bits, possibly due to a failed wire in 
the plated wire memory. 

These 18 anomalies, in general, are typical of the types of prob- 
lems routinely encountered with ground-based computers. That is, the 
space environment does not appear to have introduced any "new" types of 
anomalies. With regard to severity, tne anomalies associated with the 
manory problems caused degradation. It appears that the four programming 
error anomalies would also have resulted in degradation had reprogramming 
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not been possible. All other anomalies can be classified as intermittents 
that* after varying periods of time, did not recur. At least half of 
these could have posed serious problems had they continued. 

With respect to the number of anomalies reported, the record can 
best be judged by comparison to other components. There were also 18 
anomalies charged against telemetry sensors in this update, yet there are 
at least two orders of magnitude more telemetry sensors than computers 
in the sample. There are 15 anomalies charged against sun sensors in 
the update, which also considerably outnumber computers. This, of course, 
does not account for complexity. Command and control, which is more 
equivalent in terms of complexity, had slightly over twice as many anom- 
alies as computers. Again, however, command and control functions greatly 

> 

outnumber computers in the data sample. Based on these comparisons as well 
as consideration of the 80,000 hours of survival time, 18 anomalies seems 
a somewhat large but not excessive number. 

Some of these anomalies, however, appear to be types which, as 
more experience is gained, may be successfully mitigated. Judging from 
ground computer operations, programming errors will always occur to some 
extent, and can be mitigated by reprogramming. Also judging from ground 
operations, "glitches" become less prevalent as the hardware matures and 
interface conditions are better understood. This suggests that, with 
the proper implementation, on-board computers can become extremely reliable. 

III. CONCLUSIONS 

Overall, the data sample is too limited to justify broad con- 
clusions as to the on-orbit reliability of general purpose computers. 
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It does, however, appear to support the following conclusions based on the 
current state-of-the-art: 



• The space environment does not seem to have introduced 
any types of computer anomalies that differ significantly 
from ground-based computer anomalies. 

• On-board computers should have the capability for repro- 
gramming in-flight. 

• Properly designed and implemented co*;'puter hardware and 
software promises to substantially increase the reliabil- 
ity of control functions. 
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A Note on the Data Base for this Bulletin 

The Space Data Bank from which the results 
in this bulletin were derived is presented 
in PRC R-1863, On-Orbit Spacecraft Reliabil- 
ity, September 1978. For purposes of back- 
ground to this analysis, it need only be 
pointed out that the data bank contains 
orbital performance data spanning spacecraft 
from Vanguard to HEAO, a period of nearly 
20 years. Four primary data collection 
efforts have been made. This experience 
bulletin has been written in conjunction 
with the most recent effort. The first 
three collections analyzed 1399 anomalies 
from 310 spacecraft launched between 1958 
and 1972, The most recent collection 
added information on 708 anomalies from 
45 spacecraft launched in the seventies. 
These data are referred to herein as 
"this update." 
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Experience Bulletin #6 

SPECIFIC ORBITAL ANOMALIES POSING POTENTIAL RELIABILITY PROBLEMS 

Three specific types of anomalies, which had not been seen to 
any significant extent, it at all, on previous data bank studies, were 
noted during this update. On the basis that they may either denote the 
beginning of a trend, or signify some basic, underlying problem, each Is 
described below. 

I. Array Temperature Sensors : Two spacecraft in this update 

sample had array temperature sensor problems. On one of 
these spacecraft, four sensors failed-open after first 
operating intermittently. On a second spacecraft, four 
array temperature sensors also failed, and this was attri- 
buted to insufficient built-in strain relief. There are 
a number of anomalies in the data bank involving temper- 
ature sensors in general, and several other anomalies 
Involving array temperature sensors specifically. How- 
ever, the occurrence of these eight array temperature 
sensor failures over a short period of time stands out as 
unique. 

Leaks Th r ough Thin Windows : In the total data bank, 

there are four reported Incidents Involving thin windows. 
Ihese windows are typically 1.5 to 1.9 microns in thick- 
ness, and are used as "input ports" in experiments and 
detectors. Three of these incidents occurred on space- 
craft in this update. The first involved a broken ti.anium 
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window, and the reason for this breakage is unknown. In 
the second, in another experiment, the thin window had 
pin holes, allowing the leakage of methane pressurant gas. 
The third case was a ruptured window in a charged particle 
experiment, which also depleted the experiment's pres- 
surant gas. The only similar incident reported prior 
to this data bank update Involved a punctured "membrane" 
in a micrometeorite detector. The reason for the failure 
was not determined. It is not known how much hardware 
covered in the data bank had "thin" windows, but pre- 
sumably a number of experiments and scanners utilized such 
devices. The increase in the number of problems reported 
for them in this update seems significant. 

3. Catalyst Bed Susceptibility to RFI : An anomaly was ob- 

served on this update that has never been seen on previous 
data bank studies. That Is, It was reported that a thruster 
catalyst bed was sensitive to RFI under some conditions. 

This incident occurred several times. Including periods 
when various telemetry transmitters and antennas were ac- 
tivated. It is also reported that this interaction did 
not have a serious impact on the mission. No further 
information was available. There are other incidents 
involving catalyst beds in the data bank. These Include 
a decrease in catalyst bed resistance after heavy fir- 
ing: this resistance decrease later stabilized. Also, 




( 

there have been several incidents Invelvitui de^vad.itu'n 

or loss Of thrust due to degradation of the catalyst bed. ' 

There is no indication, however, that any of these ethei- 

catalyst bod anomalies were oven I'emctely associated with ; 

susceptibility to RH. * 
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